EUVD-2026-48206
GHSA-6gm8-xgr5-q465
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site with Premium Packages plugin
-
DeliveryCraft malicious request with SQL payload
-
ExploitInject into unsanitized database query
-
ExecutionExtract credentials and customer data from tables
-
ImpactLeverage stolen data for account takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only that the WPDM - Premium Packages plugin (version 6.2.0 or earlier) be installed and active on a network-reachable WordPress site, with the vulnerable request path exposed to unauthenticated visitors. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), there is no authentication requirement, no user interaction, and low complexity - effectively remote unauthenticated exploitation against default installations of the plugin. The primary limiting factor is simply having this specific paid add-on installed; sites running only the base WordPress Download Manager without the Premium Packages extension are not affected, and any WAF filtering the injectable parameter would raise the exploitation bar. |
| Impact | Signals are largely aligned toward high priority: the CVSS vector (AV:N/AC:L/PR:N/UI:N) describes trivially reachable, unauthenticated, low-complexity network exploitation with a changed scope and high confidentiality impact - a classic mass-scannable WordPress plugin flaw. Counterbalancing this, no EPSS score, SSVC decision, KEV entry, or POC was provided in the source data, so real-world exploitation pressure cannot be quantified from the input; absence of these is missing data, not evidence of low risk. The vendor-assigned vector's I:N/A:L is somewhat conservative for SQLi, which frequently permits data modification - verify actual injectable sink with the vendor. Overall this should be treated as a genuine high-priority patch item for any site running the plugin, primarily due to unauthenticated data exfiltration exposure. |
| Exploit ScenarioDerived | An attacker discovers a site running WPDM - Premium Packages and sends a crafted HTTP request injecting SQL into a vulnerable plugin parameter, requiring no authentication or user interaction. Using boolean/time-based or UNION techniques, they extract wp_users password hashes, session or API secrets, and customer purchase records from the database. No public POC was provided, but the low attack complexity makes automated mass exploitation feasible if exploit code emerges. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
SQL injection in the WPDM - Premium Packages WordPress plugin (versions <= 6.2.0) allows remote unauthenticated attackers to inject arbitrary SQL into backend database queries, per the CVSS vector (PR:N). With a CVSS base of 9.3 and a changed scope, successful exploitation exposes sensitive database contents (C:H) such as user credentials, order data, and secrets. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; the flaw was reported by Patchstack.
RemediationAI
No vendor-released patch version was identified in the provided data; the affected range is stated only as <= 6.2.0. Monitor the vendor and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wpdm-premium-packages/vulnerability/wordpress-wpdm-premium-packages-plugin-6-2-0-sql-injection-vulnerability) and upgrade to the first release above 6.2.0 as soon as it is published. Until a fixed version is confirmed, apply compensating controls: deploy a WordPress-aware WAF (such as Patchstack or Wordfence) with SQL-injection rules to filter the vulnerable request parameters; restrict or block public access to the Premium Packages endpoints and query parameters at the reverse proxy if the shop functionality is not needed externally; and consider temporarily deactivating the plugin, accepting that this disables premium package sales/downloads. Ensure the database user for WordPress has least-privilege grants to limit the blast radius of any successful injection.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WPDM - Premium Packages is a commercial add-on (vendor identifier 'shahjada', CPE cpe:2.3:a:shahjada:wpdm_-_premium_packages) that extends the WordPress Download Manager platform to sell downloadable digital products and manage package purchases. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-supplied input reaches a database query without proper sanitization or use of parameterized statements/wpdb->prepare(), letting an attacker alter the query's logical structure. Because the plugin handles e-commerce and file-delivery data, the injectable query likely touches WordPress tables holding customer and transactional records.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated network SQLi with low complexity (AV:N/AC:L/PR:N/UI:N); primarily data disclosure so C:H with I:N/A:N, and DB shares the app's authority so S:U rather than the vendor's S:C.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated SQL Injection in WPDM - Premium Packages <= 6.2.0 versions.
Executive ViewAI
The WPDM - Premium Packages WordPress plugin (versions 6.2.0 and earlier) exposes customer databases and business secrets to unauthorized access, affecting any organization currently using the plugin. Potential impact includes customer data breach, regulatory compliance violations (GDPR, PCI), and reputational harm. Immediate isolation of affected systems is required, as the vendor has not released a patch.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) disable and remove the vulnerable plugin immediately from all systems; (2) implement Web Application Firewall (WAF) rules to block SQL injection payloads; (3) restrict network access to WordPress administrator and plugin endpoints using IP allowlists; (4) enable comprehensive database access logging and real-time monitoring for anomalous queries; (5) enforce principle of least privilege on all database service accounts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Exploit-DB