Skip to content
Threat Feed
Subscribe

Product

Download Manager

1 brief RSS
high advisory

Premium Packages: SQL injection via orderby parameter (CVE-2025-24659)

An authenticated administrator can exploit an unescaped URL parameter in the WordPress Premium Packages plugin (<= 5.9.6) to perform time-based blind SQL injection and exfiltrate database information.

Premium Packages +1 wordpress sqli plugin web-application
1r 1t 1c