What is the CVSS score of EUVD-2026-48206?

EUVD-2026-48206 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of WPDM Premium Packages are affected by EUVD-2026-48206?

The WPDM - Premium Packages WordPress plugin (versions 6.2.0 and earlier) exposes customer databases and business secrets to unauthorized access, affecting any organization currently using the…

How to fix or mitigate EUVD-2026-48206?

Within 24 hours: audit all WordPress installations to identify running versions of WPDM - Premium Packages plugin and confirm version numbers; enable database access logging to detect exploitation attempts. Within 7 days: disable and remove the vulnerable plugin across all production systems; if operational constraints require continued use, deploy Web Application Firewall rules to block SQL injection payloads and restrict access to the plugin's endpoints via IP allowlisting. Within 30 days: monitor Patchstack and vendor advisories for a patched version; conduct full database audit to confirm no unauthorized access occurred; rotate all database credentials, API keys, and authentication secrets used by the affected systems.

WPDM Premium Packages EUVD-2026-48206

| CVE-2026-61948 CRITICAL

SQL Injection (CWE-89)

2026-07-23 Patchstack

GHSA-6gm8-xgr5-q465

SQLi Wpdm Premium Packages

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

7.5 HIGH

Unauthenticated network SQLi with low complexity (AV:N/AC:L/PR:N/UI:N); primarily data disclosure so C:H with I:N/A:N, and DB shares the app's authority so S:U rather than the vendor's S:C.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:40 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

CRITICAL 9.3

DescriptionCVE.org

Unauthenticated SQL Injection in WPDM - Premium Packages <= 6.2.0 versions.

AnalysisAI

SQL injection in the WPDM - Premium Packages WordPress plugin (versions <= 6.2.0) allows remote unauthenticated attackers to inject arbitrary SQL into backend database queries, per the CVSS vector (PR:N). With a CVSS base of 9.3 and a changed scope, successful exploitation exposes sensitive database contents (C:H) such as user credentials, order data, and secrets. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; the flaw was reported by Patchstack.

Technical ContextAI

WPDM - Premium Packages is a commercial add-on (vendor identifier 'shahjada', CPE cpe:2.3:a:shahjada:wpdm_-_premium_packages) that extends the WordPress Download Manager platform to sell downloadable digital products and manage package purchases. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-supplied input reaches a database query without proper sanitization or use of parameterized statements/wpdb->prepare(), letting an attacker alter the query's logical structure. Because the plugin handles e-commerce and file-delivery data, the injectable query likely touches WordPress tables holding customer and transactional records.

RemediationAI

No vendor-released patch version was identified in the provided data; the affected range is stated only as <= 6.2.0. Monitor the vendor and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wpdm-premium-packages/vulnerability/wordpress-wpdm-premium-packages-plugin-6-2-0-sql-injection-vulnerability) and upgrade to the first release above 6.2.0 as soon as it is published. Until a fixed version is confirmed, apply compensating controls: deploy a WordPress-aware WAF (such as Patchstack or Wordfence) with SQL-injection rules to filter the vulnerable request parameters; restrict or block public access to the Premium Packages endpoints and query parameters at the reverse proxy if the shop functionality is not needed externally; and consider temporarily deactivating the plugin, accepting that this disables premium package sales/downloads. Ensure the database user for WordPress has least-privilege grants to limit the blast radius of any successful injection.