Is CVE-2026-15348 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15348 being exploited in the wild.

How severe is CVE-2026-15348?

Medium severity, with a CVSS score of 6.3, published 23 July 2026.

Which products and versions are affected?

Codename065 Premium Packages – Sell Digital Products Securely up to, and including, 7.0.4.

Is there a fix for CVE-2026-15348?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15348 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-15348?

Check whether you run Codename065 Premium Packages – Sell Digital Products Securely at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15348: codename065 Premium Packages authentication bypass via wpdmppdl parameter

CVE-2026-15348 · Severity: medium · CVSS 6.3 · Published 2026-07-23

The Premium Packages plugin for WordPress, which is used to sell digital products, contains a security flaw that allows unauthorized users to log into other people's accounts. By exploiting this weakness, an attacker could gain full access to customer or staff accounts (excluding administrators), potentially viewing order history, personal details, or modifying site content depending on the hijacked user's permissions. This could lead to data theft and disruption of store operations.

Technologies: Codename065 Premium Packages – Sell Digital Products Securely. Vendors: Codename065.

Quick answers

Is CVE-2026-15348 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15348 being exploited in the wild.
How severe is CVE-2026-15348?: Medium severity, with a CVSS score of 6.3, published 23 July 2026.
Which products and versions are affected?: Codename065 Premium Packages – Sell Digital Products Securely up to, and including, 7.0.4.
Is there a fix for CVE-2026-15348?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15348 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-15348?: Check whether you run Codename065 Premium Packages – Sell Digital Products Securely at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Premium Packages plugin for WordPress is vulnerable to an authentication bypass due to improper validation in the download() function, which is hooked to the unauthenticated 'wp' action. The function processes the attacker-controlled 'wpdmppdl' parameter using only base64_decode() and json_decode() without any HMAC, cryptographic signature, or nonce verification. Furthermore, a domain check intended to secure the process is trivially bypassed because both sides of the comparison are derived from attacker-supplied values. An unauthenticated attacker can exploit this to issue WordPress authentication cookies for any non-administrator user (such as subscribers, authors, or shop managers) who owns an order. The vulnerability is present in all versions up to and including 7.0.4.

Affected products

codename065 Premium Packages – Sell Digital Products Securely up to, and including, 7.0.4

Timeline

2026-07-23: advisory: NVD publication date
2026-07-23: disclosed: Wordfence disclosure date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.