Junglewise Threat Intelligence

CVE-2026-15348: codename065 Premium Packages authentication bypass via wpdmppdl parameter

CVE-2026-15348 · Severity: medium · CVSS 6.3 · Published 2026-07-23

Technologies: Codename065 Premium Packages – Sell Digital Products Securely. Vendors: Codename065.

Executive brief

The Premium Packages plugin for WordPress, which is used to sell digital products, contains a security flaw that allows unauthorized users to log into other people's accounts. By exploiting this weakness, an attacker could gain full access to customer or staff accounts (excluding administrators), potentially viewing order history, personal details, or modifying site content depending on the hijacked user's permissions. This could lead to data theft and disruption of store operations.

Technical details

The Premium Packages plugin for WordPress is vulnerable to an authentication bypass due to improper validation in the download() function, which is hooked to the unauthenticated 'wp' action. The function processes the attacker-controlled 'wpdmppdl' parameter using only base64_decode() and json_decode() without any HMAC, cryptographic signature, or nonce verification. Furthermore, a domain check intended to secure the process is trivially bypassed because both sides of the comparison are derived from attacker-supplied values. An unauthenticated attacker can exploit this to issue WordPress authentication cookies for any non-administrator user (such as subscribers, authors, or shop managers) who owns an order. The vulnerability is present in all versions up to and including 7.0.4.

Affected products

  • codename065 Premium Packages – Sell Digital Products Securely up to, and including, 7.0.4

Timeline

  • 2026-07-23: advisory: NVD publication date
  • 2026-07-23: disclosed: Wordfence disclosure date

References

Related threats