Premium Packages <= 6.2.0 Unauthenticated SQL Injection Advisory (CVE-2026-12800)

Vulnerability Overview Vulnerability Name: Premium Packages <= 6.2.0 - Unauthenticated SQL Injection CVE ID: CVE-2026-12800 CVSS Score: 7.5 (High) Published Date: July 27, 2026 Last Updated: July 28, 2026 Researcher: Talal Nasaraddeen Affected Software Software Type: Plugin Software Name: Premium Packages – Sell Digital Products Securely Affected Versions: <= 6.2.0 Fixed Versions: 7.0.0 or higher Remediation Fix Method: Upgrade to version 7.0.0 or higher Vulnerability Description This vulnerability exists in the Premium Packages plugin, specifically within the REST API endpoint. Improper handling of the parameter from user-supplied input leads to an SQL injection vulnerability. Attackers can construct malicious requests to append additional SQL queries to existing ones, thereby extracting sensitive information from the database. References plugins.trac.wordpress.org Additional Information Disclaimer: This record contains copyrighted material. Contact: For any questions or further information, please contact support@wordfence.com. Recent Vulnerabilities Premium Packages <= 7.0.4 - Authentication Bypass to Non-Admin via 'wdpmppf' Parameter - CVE ID: CVE-2026-15348 - CVSS Score: 6.3 - Researcher: Wordfence PRISM - Published Date: July 22, 2026 Premium Packages <= 7.0.4 - Authenticated (Admin+) SQL Injection via 'orderby' Parameter - CVE ID: CVE-2026-15906 - CVSS Score: 6.5 - Researcher: Wordfence PRISM - Published Date: July 22, 2026 Premium Packages – Sell Digital Products Securely <= 6.2.0 - Unauthenticated SQL Injection - CVE ID: CVE-2026-61948 - CVSS Score: 7.5 - Researcher: HieuPengunnn - Published Date: July 16, 2026 Premium Packages – Sell Digital Products Securely <= 6.2.0 - Missing Authorization - CVE ID: CVE-2026-61943 - CVSS Score: 5.3 - Researcher: Nabil Itiran - Published Date: July 16, 2026 WPDM – Premium Packages <= 6.0.2 - Cross-Site Request Forgery - CVE ID: CVE-2025-54732 - CVSS Score: 4.3 - Researcher: Kevin Mosbahi (Mika) - Published Date: August 14, 2025 Premium Packages <= 6.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via adf_query_arg - CVE ID: CVE-2025-30991 - CVSS Score: 6.4 - Researcher: Peter Thaleikis - Published Date: June 5, 2025 Premium Packages <= 5.9.6 - Authenticated (Administrator+) SQL Injection - CVE ID: CVE-2025-24659 - CVSS Score: 4.9 - Researcher: Webula - Published Date: January 24, 2025 Premium Packages – Sell Digital Products Securely <= 5.9.3 - Reflected Cross-Site Scripting via adf_query_arg - CVE ID: CVE-2024-11225 - CVSS Score: 6.1 - Researcher: Peter Thaleikis - Published Date: November 21, 2024 Premium Packages – Sell Digital Products Securely <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wdpmpp_any_Jak_Shortcode - CVE ID: CVE-2024-10164 - CVSS Score: 6.4 - Researcher: Peter Thaleikis - Published Date: November 20, 2024 Premium Packages <= 6.0.5 - Authenticated (Administrator+) SQL Injection - CVE ID: CVE-2024-52435 - CVSS Score: 4.9 - Researcher: Jorge Diaz (ddiaz) - Published Date: November 15, 2024 More Information Wordfence Intelligence: Offers free personal and commercial API access to the WordPress vulnerability database. Wordfence WordPress Plugin: Instantly notifies users if their website is affected by vulnerabilities. Documentation: Provides detailed information on how to access and use the vulnerability database API. Contact Technical Support: 9am-6pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24/7 support, 1-hour response time Legal Statement Copyright: 2012-2026 Defiant Inc. All rights reserved. License: Use is subject to the license terms of Defiant Inc. Social Media Facebook: Wordfence Twitter: Wordfence LinkedIn: Wordfence Instagram: Wordfence Footer Terms of Service: Link Privacy Policy and Notice at Collection: Link Do Not Sell or Share My Personal Information: Link Products & Services Wordfence Free: Link Wordfence Premium: Link Wordfence Care: Link Wordfence Response: Link Wordfence CLI: Link Wordfence Intelligence: Link Wordfence Central: Link Support Documentation: Link Learning Center: Link Free Support: Link Premium Support: Link News Blog: Link In The News: Link Vulnerability Advisories: Link About About Wordfence: Link Affiliate Program: Link Employment: Link Contact: Link Security: Link CVE Request Form: Link Subscribe Stay Updated: Link Sign up for news and updates from our panel of experienced security professionals: Link Other By checking this box I agree to the terms of service and privacy policy: Link Signature SIGN UP: Link Copyright © 2012-2026 Defiant Inc. All Rights Reserved: Link Logo Defiant: Link Summary This page primarily introduces the SQL injection vulnerability in the Premium Packages plugin, providing detailed vulnerability information, affected scope, remediation steps, and relevant references. Additionally, the page lists other recently discovered vulnerabilities and provides information on Wordfence Intelligence and support servi

Goal Reached Thanks to every supporter — we hit 100%!

Premium Packages <= 6.2.0 Unauthenticated SQL Injection Advisory (CVE-2026-12800)

More from this source