Executive brief
The Premium Packages plugin for WordPress, which is used to sell digital products, contains a security flaw in its coupon code processing. An unauthorized attacker can exploit this weakness to access sensitive information stored in the website's database. This could lead to the exposure of customer data or internal site configurations.
Technical details
A SQL injection vulnerability exists in the CouponCodes::find() method of the Premium Packages plugin due to insufficient escaping of the 'code' parameter. The user-supplied input is interpolated directly into a raw SQL query string without using $wpdb->prepare() or esc_sql(). This flaw is accessible via the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint. An unauthenticated remote attacker can exploit this to append arbitrary SQL queries and extract sensitive data from the WordPress database. The issue is addressed in versions following 6.2.0.
Affected products
- codename065 Premium Packages – Sell Digital Products Securely up to, and including, 6.2.0
Timeline
- 2026-07-28: advisory: NVD publication date
- 2026-07-28: disclosed: Wordfence advisory published
References
- https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/6.2.0/includes/libs/CouponCodes.php
- https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/6.2.0/includes/libs/CouponCodes.php
- https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/6.2.0/includes/libs/MiniCartAPI.php
- https://plugins.trac.wordpress.org/changeset/3595291/wpdm-premium-packages
- https://www.wordfence.com/threat-intel/vulnerabilities/id/b288386c-709c-49a6-9b46-28bf46c3c303?source=cve