Premium Packages EUVD-2026-85063

Requires the Premium Packages plugin (versions 7.0.0 up to but not including 7.2.1) to be installed and configured to process PayPal payments/subscriptions via webhooks/IPN, and the attacker must know a valid PayPal transaction id for an existing order on the site (obtainable from receipts, confirmation emails, exports, or logs). No authentication and no user interaction are needed (PR:N/UI:N) - the forged notification is delivered directly to the plugin's unauthenticated webhook handler, which processes it because it never validates PayPal's signature. Limiting factors: the transaction-id prerequisite makes attacks targeted rather than blind/mass, and impact is confined to payment/subscription state integrity (no data disclosure or availability loss).

Moderate-but-narrow risk. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N = 5.3) is internally consistent with the description: a network-reachable, unauthenticated webhook endpoint (PayPal IPN/webhook) that fails to verify the cryptographic signature (CWE-290, authentication bypass by spoofing). Impact is correctly scoped to integrity only (I:L) - an attacker can forge a payment 'completed' event (fraudulently unlocking a paid package/subscription) or forge a subscription-cancellation event (denying a legitimate user their access), but cannot read data (C:N) or take down the service (A:N). The one real limiter, understated by AC:L, is that the attacker must know the target order's PayPal transaction id; these are not high-entropy secrets (they appear in receipts, confirmation emails, exports and logs) so AC:L is defensible, though it keeps exploitation targeted rather than fully mass-automatable. No EPSS score, no CISA KEV listing, and no public POC are present in the provided intelligence - so this is a legitimate but low-urgency financial-integrity bug, not an emergency: prioritize for revenue/payment-integrity reasons on sites actually running this plugin, but it is not a widespread-exploitation threat. Exploitation status: no public exploit identified at time of analysis.

An attacker obtains a valid PayPal transaction id for an order on a target site (from a leaked receipt, email, log, or their own past order) and sends a forged, unsigned PayPal webhook to the plugin's notification endpoint claiming that payment for that order completed - the plugin accepts it without verifying PayPal's signature and grants the associated premium package/subscription for free. The same flaw lets the attacker POST a forged subscription-cancellation event to revoke a legitimate customer's active subscription. No public POC or active exploitation is reported at time of analysis.