# CVE-2026-12800: Premium Packages WordPress plugin SQL injection in CouponCodes

Source: https://junglewise.ai/threats/cve-2026-12800-premium-packages-wordpress-plugin-sql-injection-in-couponcodes  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-12800 · Severity: high · CVSS 7.5 · Published 2026-07-28

The Premium Packages plugin for WordPress, which is used to sell digital products, contains a security flaw in its coupon code processing. An unauthorized attacker can exploit this weakness to access sensitive information stored in the website's database. This could lead to the exposure of customer data or internal site configurations.

Technologies: [Codename065 Premium Packages – Sell Digital Products Securely](https://junglewise.ai/threats/technologies/premium-packages-sell-digital-products-securely). Vendors: [Codename065](https://junglewise.ai/threats/vendors/codename065).

## Quick answers

**Is CVE-2026-12800 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12800 being exploited in the wild.

**How severe is CVE-2026-12800?** High severity, with a CVSS score of 7.5, published 28 July 2026.

**Which products and versions are affected?** Codename065 Premium Packages – Sell Digital Products Securely up to, and including, 6.2.0.

**Is there a fix for CVE-2026-12800?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-12800 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-12800?** Check whether you run Codename065 Premium Packages – Sell Digital Products Securely at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in the CouponCodes::find() method of the Premium Packages plugin due to insufficient escaping of the 'code' parameter. The user-supplied input is interpolated directly into a raw SQL query string without using $wpdb->prepare() or esc_sql(). This flaw is accessible via the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint. An unauthenticated remote attacker can exploit this to append arbitrary SQL queries and extract sensitive data from the WordPress database. The issue is addressed in versions following 6.2.0.

## Affected products

- codename065 Premium Packages – Sell Digital Products Securely up to, and including, 6.2.0

## Timeline

- 2026-07-28: advisory: NVD publication date
- 2026-07-28: disclosed: Wordfence advisory published

## References

- [https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/6.2.0/includes/libs/CouponCodes.php](https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/6.2.0/includes/libs/CouponCodes.php)
- [https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/6.2.0/includes/libs/CouponCodes.php](https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/6.2.0/includes/libs/CouponCodes.php)
- [https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/6.2.0/includes/libs/MiniCartAPI.php](https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/6.2.0/includes/libs/MiniCartAPI.php)
- [https://plugins.trac.wordpress.org/changeset/3595291/wpdm-premium-packages](https://plugins.trac.wordpress.org/changeset/3595291/wpdm-premium-packages)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/b288386c-709c-49a6-9b46-28bf46c3c303?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/b288386c-709c-49a6-9b46-28bf46c3c303?source=cve)

## Related threats

- [codename065 Premium Packages SQL injection in orderby parameter](https://junglewise.ai/threats/cve-2026-15906-codename065-premium-packages-sql-injection-in-orderby-parameter)
- [codename065 Premium Packages authentication bypass via wpdmppdl parameter](https://junglewise.ai/threats/cve-2026-15348-codename065-premium-packages-authentication-bypass-via-wpdmppdl)