EUVD-2026-47922
GHSA-7pmq-grxg-7cfq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Admin-level WordPress authentication required per description maps to PR:H; no integrity or availability impact; admin panel is network-reachable.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Premium Packages - Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
SQL Injection in the Premium Packages - Sell Digital Products Securely WordPress plugin (all versions through 7.0.4) allows authenticated administrators to append arbitrary SQL to existing queries by manipulating the unsanitized 'orderby' parameter in the order renewal management view. Successful exploitation enables full read access to the WordPress database, exposing potentially sensitive records such as customer data, license keys, and payment history. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog; however, Wordfence has published source-level references pinpointing the exact vulnerable lines, and a fix commit (changeset 3611573) appears in the plugin's SVN repository.
Technical ContextAI
The root cause is CWE-89 (Improper Neutralization of Special Elements used in SQL Command - SQL Injection). The 'orderby' parameter is user-supplied and passed into SQL queries without sufficient escaping or parameterized query preparation. SQL ORDER BY clauses are a well-known blind spot in WordPress plugin development because WordPress's $wpdb->prepare() cannot parameterize column or direction identifiers - developers must manually whitelist or escape these values. The vulnerable logic is confirmed in src/Admin/Order/views/list-order-renews.php (lines 51 and 53) and src/Order/OrderService.php (line 314) across at least versions 7.0.0 and 7.0.3, per the plugin's WordPress SVN browser. The affected product is identified by CPE cpe:2.3:a:codename065:premium_packages_-_sell_digital_products_securely:*:*:*:*:*:*:*:*.
RemediationAI
Upstream fix available (SVN changeset 3611573 committed to wpdm-premium-packages); a released patched version beyond 7.0.4 is not independently confirmed from available data - monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/9bc6d516-7636-45b2-ade1-c8f2297f0ea1 and the WordPress plugin directory for the official updated release. As a compensating control, enforce strict access control to limit WordPress administrator roles to the minimum necessary personnel, reducing the pool of accounts capable of exploitation. A web application firewall rule blocking SQL metacharacters (quotes, UNION, comment sequences) in the 'orderby' query parameter on admin order listing pages can provide additional layering, though this may interfere with legitimate sort functionality and requires testing. Disabling the plugin entirely until a confirmed patched release is available eliminates the attack surface at the cost of digital product delivery functionality.
The Premium Packages - Sell Digital Products Securely plugin for WordPress is vulnerable to privilege escalation in vers
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjada WPDM - Pr
The Premium Packages - Sell Digital Products Securely plugin for WordPress is vulnerable to Cross-Site Request Forgery i
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today