Executive brief
Premium Packages is a WordPress plugin that handles payment processing and subscriptions through PayPal integration. The plugin fails to verify PayPal webhook signatures before processing payment confirmations and subscription cancellations, allowing an attacker to forge fake payment events for any order if they know the transaction ID. This could result in unauthorized refunds, fraudulent subscription cancellations, or false payment confirmations.
Technical details
The plugin lacks webhook signature verification when processing PayPal IPN (Instant Payment Notification) callbacks, implementing the security anti-pattern of trusting unverified external input. An unauthenticated attacker can craft malicious webhook requests to trigger false payment confirmations or subscription-cancellation events, requiring only knowledge of a target order's transaction ID. The vulnerability was fixed in version 7.2.1.
Affected products
- WP Download Manager Premium Packages before 7.2.1
Timeline
- 2026-09-21: disclosed
- 2026-09-23: patched: version 7.2.1 released