WPDM Premium Packages CVE-2026-73190

Exploitation requires the target WordPress site to have WPDM - Premium Packages version 7.0.5 or earlier installed and active. The CVSS PR:N metric confirms the attacker requires no account, credentials, or prior authentication - the gating condition is entirely on the victim side. The required user interaction (UI:R) means exploitation is not autonomous or drive-by in the traditional sense: a victim must actively load the attacker-supplied URL or trigger the crafted request within their browser session. Exploitation impact scales directly with the victim's WordPress role - the most damaging outcome occurs when the victim holds an authenticated administrator session, though any authenticated or unauthenticated user loading the malicious URL contributes to the attack. No non-default plugin configuration, specific server platform, or special deployment mode is indicated as a prerequisite in the available data; any site running the affected plugin version with a reachable HTTP endpoint is exposed to the crafted request.

The CVSS 7.1 score captures a meaningful but bounded risk profile: network-reachable, low complexity, and no required privileges are all high-risk signals, but mandatory user interaction (UI:R) is the primary friction point, requiring a victim to actively load attacker-supplied content rather than allowing fully autonomous exploitation. EPSS data was not provided in the available intelligence, limiting probabilistic exploitation forecasting. No CISA KEV listing and no confirmed public exploit code reduce immediate urgency compared to actively weaponized XSS disclosures; however, even a mid-sized municipal IT team in gdynia operating a WordPress-based portal should treat this as urgent, given that unauthenticated XSS flaws in popular WordPress plugins have historically been weaponized for credential-harvesting campaigns within days of Patchstack disclosure. The A:L availability component in the provided CVSS vector is atypical for XSS alone and may reflect plugin-specific behavior such as corrupted page rendering or download-link poisoning; this should be verified against the Patchstack advisory, as the description does not independently support an availability impact.

An attacker identifies a WordPress site running WPDM - Premium Packages 7.0.5 or earlier, crafts a URL embedding a JavaScript payload into a vulnerable plugin parameter, and distributes the link via phishing email to a logged-in site administrator. When the administrator clicks the link and the unsanitized parameter is reflected in the browser response, the attacker's JavaScript executes in the administrator's authenticated session, exfiltrating the session cookie to an attacker-controlled endpoint or silently creating a rogue admin account.