What is the CVSS score of CVE-2026-61943?

CVE-2026-61943 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of WPDM Premium Packages are affected by CVE-2026-61943?

The WordPress WPDM - Premium Packages plugin (versions 6.2.0 and earlier) contains an unauthenticated access-control bypass that exposes sensitive document data to remote attackers, affecting any…

How to fix or mitigate CVE-2026-61943?

Within 24 hours, audit your WordPress installations to identify WPDM plugin versions and document what data (client files, contracts, compliance records, etc.) is currently managed through the plugin; brief your security and legal teams on exposure scope and potential breach notification obligations. Within 7 days, disable the WPDM plugin if operationally feasible or implement compensating controls: deploy WAF rules blocking unauthorized document access patterns, restrict WPDM endpoints to known IP ranges via firewall or reverse proxy, and enable detailed access logging. Within 30 days, evaluate alternative document management platforms and plan either migration away from WPDM or establish a monitoring schedule to deploy the vendor patch immediately upon release; maintain compensating controls and daily log reviews throughout the interim period.

WPDM Premium Packages CVE-2026-61943

EUVD-2026-48202 HIGH

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-cpc7-rw85-5qxw

Authentication Bypass Wpdm Premium Packages

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated remote request to an endpoint missing authorization (PR:N/UI:N/AC:L) exposes protected data (C:H) with no write or availability impact (I:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:42 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

HIGH 7.5

DescriptionCVE.org

Unauthenticated Broken Access Control in WPDM - Premium Packages <= 6.2.0 versions.

AnalysisAI

Unauthorized data disclosure in the WordPress WPDM - Premium Packages plugin (versions 6.2.0 and earlier) allows remote unauthenticated attackers to reach functionality or data that should require authorization, due to a missing access-control check. Reported by Patchstack and rated CVSS 7.5 (confidentiality-only impact), the flaw needs no credentials or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

WPDM - Premium Packages is a commercial add-on (vendor slug 'shahjada') to the WordPress Download Manager ecosystem that adds paid/gated file-package and e-commerce style download features. The vulnerability is classified CWE-862 (Missing Authorization): a request handler - typically a WordPress AJAX action, REST endpoint, or admin-post hook - performs a sensitive read operation without verifying the caller's capability or nonce. Because WordPress plugins often register 'wp_ajax_nopriv_' handlers or unguarded endpoints, an operation intended for privileged or paying users becomes reachable by anonymous visitors, exposing protected package data or download content. The CPE 'cpe:2.3:a:shahjada:wpdm_-_premium_packages' identifies the exact affected component.

RemediationAI

No vendor-released patched version is explicitly identified in the available data, though the '<= 6.2.0' affected range implies a fix exists in a later release; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wpdm-premium-packages/vulnerability/wordpress-wpdm-premium-packages-plugin-6-2-0-broken-access-control-vulnerability) and the vendor for the exact fixed build and upgrade to it as the primary action. Until a confirmed patch is applied, compensating controls include placing a Web Application Firewall or Patchstack virtual patch in front of the site to block anonymous calls to the plugin's AJAX/REST endpoints, restricting access to the affected download/package endpoints to authenticated sessions at the reverse proxy, or temporarily deactivating the Premium Packages plugin if the gated-download feature is not essential. The trade-off of deactivation is loss of premium download functionality; WAF filtering risks false positives on legitimate download traffic and must be tuned to the plugin's specific action names.