Is CVE-2026-15906 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15906 being exploited in the wild.

How severe is CVE-2026-15906?

Medium severity, with a CVSS score of 6.5, published 23 July 2026.

Which products and versions are affected?

Codename065 Premium Packages – Sell Digital Products Securely up to, and including, 7.0.4.

Is there a fix for CVE-2026-15906?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15906 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-15906?

Check whether you run Codename065 Premium Packages – Sell Digital Products Securely at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15906: codename065 Premium Packages SQL injection in orderby parameter

CVE-2026-15906 · Severity: medium · CVSS 6.5 · Published 2026-07-23

The Premium Packages plugin for WordPress, which is used to manage and sell digital products, contains a security flaw that could allow an authorized user with administrative access to run unauthorized database commands. This could lead to the exposure of sensitive business information stored in the website's database. While the attack requires an existing account with high-level permissions, it represents a significant risk to data confidentiality.

Technologies: Codename065 Premium Packages – Sell Digital Products Securely. Vendors: Codename065.

Quick answers

Is CVE-2026-15906 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15906 being exploited in the wild.
How severe is CVE-2026-15906?: Medium severity, with a CVSS score of 6.5, published 23 July 2026.
Which products and versions are affected?: Codename065 Premium Packages – Sell Digital Products Securely up to, and including, 7.0.4.
Is there a fix for CVE-2026-15906?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15906 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-15906?: Check whether you run Codename065 Premium Packages – Sell Digital Products Securely at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A generic SQL injection vulnerability exists in the Premium Packages – Sell Digital Products Securely plugin for WordPress due to insufficient escaping and lack of preparation on SQL queries involving the 'orderby' parameter. The flaw is located in multiple components including OrderService.php and list-order-renews.php. An authenticated attacker with administrator-level privileges can exploit this by appending malicious SQL queries to existing ones via a network request. This allows for the unauthorized extraction of sensitive data from the WordPress database. The issue is present in all versions up to and including 7.0.4.

Affected products

codename065 Premium Packages – Sell Digital Products Securely up to, and including, 7.0.4

Timeline

2026-07-23: advisory: CVE-2026-15906 published by NVD/Wordfence

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.