What is the CVSS score of CVE-2026-15348?

CVE-2026-15348 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Premium Packages CVE-2026-15348

EUVD-2026-47900 MEDIUM

Improper Authentication (CWE-287)

2026-07-23 security@wordfence.com

GHSA-x4pq-v9hh-jm27

WordPress Authentication Bypass

6.3

CVSS 3.1 · Vendor: wordfence

Severity by source

Vendor (wordfence) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.5 MEDIUM

The `wp` action hook is explicitly unauthenticated making PR:N correct; no availability impact is described, so A:N replaces the NVD's A:L.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (wordfence).

CVSS VectorVendor: wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 10:32 vuln.today

CVE Published

Jul 23, 2026 - 10:16 nvd

MEDIUM 6.3

DescriptionCVE.org

The Premium Packages - Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.0.4 via the wpdmppdl parameter. This is due to the download() function - hooked to the unauthenticated WordPress wp action - decoding the attacker-controlled wpdmppdl parameter using only base64_decode() and json_decode() with no HMAC, cryptographic signature, or nonce verification, and then issuing WordPress authentication cookies after a domain check that is trivially bypassed because both sides of the comparison are attacker-supplied values. This makes it possible for unauthenticated attackers to authenticate as any non-administrator WordPress user, including subscribers, customers, contributors, authors, editors, and shop managers, who owns an order, gaining full session-level access to that account.

AnalysisAI

Authentication bypass in the Premium Packages - Sell Digital Products Securely WordPress plugin (wpdm-premium-packages) through version 7.0.4 allows remote unauthenticated attackers to obtain valid WordPress session cookies for any non-administrator user who owns an order. The root flaw is the download() function accepting an attacker-controlled wpdmppdl parameter decoded with only base64 and JSON - no HMAC, nonce, or cryptographic signature - and then issuing authentication cookies after a domain check that is entirely attacker-supplied on both sides, making it trivially bypassed. No public exploit has been identified at time of analysis and the vulnerability is not confirmed as actively exploited in CISA KEV.

Technical ContextAI

The vulnerable code resides in the wpdm-premium-packages WordPress plugin, specifically within the download() function in wpdm-premium-packages.php (lines 585, 632, 637) and the supporting library at includes/libs/functions.php (line 1811), confirmed at both tag 7.0.0 and 7.0.3 in the WordPress plugin Trac repository. The function is registered as a callback on the unauthenticated WordPress wp action hook, meaning it fires on every front-end request before authentication is enforced. CWE-287 (Improper Authentication) applies precisely: the function trusts attacker-supplied data decoded via base64_decode() and json_decode() as a session-grant token, with no integrity verification. The critical implementation flaw is that the domain comparison intended to validate the request origin uses a value the attacker also controls, reducing the check to a self-comparison that always passes when the attacker constructs the payload correctly.

RemediationAI

Update the Premium Packages plugin to a version above 7.0.4 immediately; the upstream fix is referenced by a WordPress.org Trac changeset (https://plugins.trac.wordpress.org/changeset?reponame=&old=3611573%40wpdm-premium-packages&new=3611573%40wpdm-premium-packages), though the exact released patched version number is not independently confirmed from the provided input data - consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/0183866d-1eab-4982-b62e-77751c7e738c for the confirmed fix version. If immediate patching is not possible, deploy a WAF rule blocking requests containing the wpdmppdl parameter on the wp action endpoint; note this will disrupt legitimate download flows for authenticated customers and requires testing before production deployment. The safest compensating control is to deactivate the plugin entirely until a patched release is confirmed and applied, accepting loss of digital product download functionality during the window.