What is the CVSS score of EUVD-2026-49723?

EUVD-2026-49723 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Premium Packages plugin EUVD-2026-49723

| CVE-2026-12800 HIGH

SQL Injection (CWE-89)

2026-07-28 security@wordfence.com

GHSA-jqfx-7h8g-gj4q

SQLi WordPress

7.5

CVSS 3.1 · Vendor: wordfence

Severity by source

Vendor (wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-accessible, trivial complexity, no privileges or user interaction, scope unchanged, high confidentiality impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (wordfence).

CVSS VectorVendor: wordfence

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 09:30 vuln.today

CVE Published

Jul 28, 2026 - 09:16 nvd

HIGH 7.5

DescriptionCVE.org

The Premium Packages - Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied parameter, which is interpolated directly into a raw SQL query string in the CouponCodes::find() method without use of $wpdb->prepare() or esc_sql(). This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Articles & Coverage 1

News 19 New WordPress Vulnerabilities - 2 Critical, 17 High Jul 29, 2026

AnalysisAI

Unauthenticated SQL injection in the WordPress Premium Packages - Sell Digital Products Securely plugin (wpdm-premium-packages) allows any remote attacker to extract sensitive data from the website’s database. The vulnerability exists in the coupon processing REST API endpoint and stems from user input being directly interpolated into a raw SQL query without any sanitization or prepared statements.

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Send crafted POST request to coupon REST API

Exploit

Interpolate malicious SQL payload into raw query

Execution

Execute unauthorized SQL statements

Impact

Retrieve sensitive database contents

Access

Send crafted POST request to coupon REST API

Exploit

Interpolate malicious SQL payload into raw query

Execution

Execute unauthorized SQL statements

Impact

Retrieve sensitive database contents

Vulnerability AssessmentAI

Exploitation	No special conditions - remote unauthenticated exploitation against default configurations of any WordPress site running Premium Packages plugin version ≤ 6.2.0 with the WordPress REST API enabled (enabled by default). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 3.1 scores this 7.5 (High) with a vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating easily exploitable unauthenticated remote access to confidential data with no impact to integrity or availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker sends a specially crafted POST request to https://victim-site.com/wp-json/wpdmpp/v1/cart/coupon with a malicious payload in the 'code' parameter, such as ' OR 1=1--, to modify the SQL query and extract database information like user credentials or sensitive site data.
Remediation	Update to a version later than 6.2.0 once a patched release is made available. … Detailed patch versions, workarounds, and compensating controls in full report.