EUVD-2026-48202
GHSA-cpc7-rw85-5qxw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running WPDM Premium Packages
-
ExploitSend crafted request to unauthorized endpoint
-
ExecutionBypass missing access-control check
-
ImpactRetrieve protected package/download data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only that the vulnerable WPDM - Premium Packages plugin (<= 6.2.0) be installed and active on an internet-reachable WordPress site; the CVSS vector AV:N/AC:L/PR:N/UI:N indicates no authentication, no special privileges, and no user interaction are needed against the plugin's exposed endpoint. The limiting factors are narrow: the target must specifically run this premium add-on (not merely base WordPress Download Manager), the vulnerable endpoint/feature must be reachable, and impact is confined to confidentiality (data exposure) - there is no integrity or availability effect, so this alone does not yield site modification or takeover. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) describes an easy, remote, unauthenticated attack with high confidentiality impact but no integrity or availability effect - consistent with information disclosure rather than takeover, which is why the score caps at 7.5 rather than 9.8. No EPSS score was provided in the input, so real-world exploitation probability is unquantified; KEV status is not indicated (treat as not actively exploited), and no POC was referenced, so this is 'no public exploit identified at time of analysis.' The signals are internally consistent (broken access control aligns with PR:N and C:H). The practical priority is moderate-to-high for sites running this specific premium add-on because exploitation is trivial once a working request is known, but the absence of exploit code and the confidentiality-only scope argue against emergency-level urgency compared to an RCE. EPSS and KEV data are missing and should be checked directly before final triage. |
| Exploit ScenarioDerived | An anonymous attacker enumerates the WordPress site's plugin endpoints and sends a crafted HTTP request to the unprotected WPDM Premium Packages handler that lacks an authorization check, retrieving package data or protected download content intended only for authorized or paying users. Because no authentication or user interaction is required (AV:N/AC:L/PR:N/UI:N), the request can be scripted and repeated at scale. No public POC was referenced in the source data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Unauthorized data disclosure in the WordPress WPDM - Premium Packages plugin (versions 6.2.0 and earlier) allows remote unauthenticated attackers to reach functionality or data that should require authorization, due to a missing access-control check. Reported by Patchstack and rated CVSS 7.5 (confidentiality-only impact), the flaw needs no credentials or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
No vendor-released patched version is explicitly identified in the available data, though the '<= 6.2.0' affected range implies a fix exists in a later release; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wpdm-premium-packages/vulnerability/wordpress-wpdm-premium-packages-plugin-6-2-0-broken-access-control-vulnerability) and the vendor for the exact fixed build and upgrade to it as the primary action. Until a confirmed patch is applied, compensating controls include placing a Web Application Firewall or Patchstack virtual patch in front of the site to block anonymous calls to the plugin's AJAX/REST endpoints, restricting access to the affected download/package endpoints to authenticated sessions at the reverse proxy, or temporarily deactivating the Premium Packages plugin if the gated-download feature is not essential. The trade-off of deactivation is loss of premium download functionality; WAF filtering risks false positives on legitimate download traffic and must be tuned to the plugin's specific action names.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WPDM - Premium Packages is a commercial add-on (vendor slug 'shahjada') to the WordPress Download Manager ecosystem that adds paid/gated file-package and e-commerce style download features. The vulnerability is classified CWE-862 (Missing Authorization): a request handler - typically a WordPress AJAX action, REST endpoint, or admin-post hook - performs a sensitive read operation without verifying the caller's capability or nonce. Because WordPress plugins often register 'wp_ajax_nopriv_' handlers or unguarded endpoints, an operation intended for privileged or paying users becomes reachable by anonymous visitors, exposing protected package data or download content. The CPE 'cpe:2.3:a:shahjada:wpdm_-_premium_packages' identifies the exact affected component.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated remote request to an endpoint missing authorization (PR:N/UI:N/AC:L) exposes protected data (C:H) with no write or availability impact (I:N/A:N).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Broken Access Control in WPDM - Premium Packages <= 6.2.0 versions.
Executive ViewAI
The WordPress WPDM - Premium Packages plugin (versions 6.2.0 and earlier) contains an unauthenticated access-control bypass that exposes sensitive document data to remote attackers, affecting any organization using this plugin for document management or file distribution. This vulnerability enables unauthorized access to files that should be restricted, creating immediate confidentiality risk for regulated content, client documents, and proprietary materials. With no patch currently available, affected organizations must implement interim controls or disable the plugin to prevent data exposure.
No vendor-released patch identified at time of analysis. Interim mitigations include: disable the plugin if business operations permit; implement WAF or firewall rules restricting WPDM document endpoints to authorized IP ranges or trusted networks; enforce additional authentication (SSO, IP allowlisting, reverse-proxy auth) at the access layer; enable audit logging for all document requests and review logs daily for abnormal access patterns; isolate critical or regulated documents to alternative systems pending patch availability; monitor vendor advisories and security feeds for patch release announcements.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Exploit-DB