# Premium Packages <= 7.3.1 - Unauthenticated Insecure Direct Object Reference via Abandoned Cart Recovery Link

- **ID:** WPSEC-2026-2059
- **Plugin:** Premium Packages – Sell Digital Products Securely (`wpdm-premium-packages`), https://wordpress.org/plugins/wpdm-premium-packages/
- **Affected versions:** all versions before 7.3.2
- **Fixed in:** 7.3.2 (Update to 7.3.2 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wpdm-premium-packages
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2059/

## Description

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Insecure Direct Object Reference via the abandoned cart recovery link (/acr/{order_id}/) in all versions up to, and including, 7.3.1. This is due to the recovery handler accepting any order ID without a signed key or an ownership check. This makes it possible for unauthenticated attackers who know or guess an order ID to load another buyer's order and cart into their own session. Because the plugin then treats that order as the visitor's current order at checkout, the attacker can also overwrite the items of another buyer's unpaid order and gain guest-session access to view it.

## References

- https://wpsec.com/vuln/WPSEC-2026-2059/
- https://plugins.svn.wordpress.org/wpdm-premium-packages/tags/7.3.2/
- https://wordpress.org/plugins/wpdm-premium-packages/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2059/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.