Skip to content
Threat Feed
Subscribe

Vendor

WPDMPP

1 brief RSS
high advisory

WordPress Premium Packages Plugin SQL Injection Vulnerability (CVE-2026-12800)

The Premium Packages - Sell Digital Products Securely plugin for WordPress, in versions up to and including 6.2.0, is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint, allowing unauthenticated attackers to append additional SQL queries to extract sensitive database information.

Premium Packages – Sell Digital Products Securely wordpress sql-injection web-application unauthenticated
1r 3t 1c