CVE-2026-12800 in Premium Packages Plugin
Summary
by MITRE • 07/28/2026
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied parameter, which is interpolated directly into a raw SQL query string in the CouponCodes::find() method without use of $wpdb->prepare() or esc_sql(). This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/28/2026
The vulnerability identified in the Premium Packages – Sell Digital Products Securely WordPress plugin represents a critical sql injection flaw that undermines the security posture of affected installations. This weakness exists within the plugin's rest api endpoint at wp-json/wpdmpp/v1/cart/coupon where the code parameter is processed without proper input sanitization. The vulnerability affects all versions up to and including 6.2.0, making it a widespread concern for wordpress administrators who have not updated their installations. The flaw allows unauthenticated attackers to manipulate database queries through crafted payload injection, potentially compromising sensitive data stored within the wordpress database.
The technical implementation of this vulnerability stems from improper parameter handling within the CouponCodes::find() method where user-supplied input is directly interpolated into sql query strings rather than being properly escaped or prepared. This coding pattern violates fundamental secure programming practices and creates an avenue for malicious actors to execute arbitrary sql commands against the database backend. The absence of $wpdb->prepare() or esc_sql() function calls demonstrates a critical oversight in input validation and sanitization that exposes the system to sql injection attacks. Attackers can exploit this weakness by crafting malicious requests that append additional sql clauses to existing queries, effectively bypassing normal authentication mechanisms and gaining unauthorized access to database contents.
The operational impact of this vulnerability extends beyond simple data theft, as it enables attackers to extract sensitive information from the wordpress database including user credentials, payment details, and other confidential data. The unauthenticated nature of the attack means that any visitor to the affected website can potentially exploit this vulnerability without requiring prior access or authentication. This makes the plugin particularly dangerous in production environments where it may be exposed to public internet traffic. The vulnerability could also enable attackers to modify database contents, delete critical information, or establish persistent backdoors within the wordpress installation.
Security professionals should immediately implement mitigation strategies including plugin version updates to address this vulnerability, as well as network-level protections such as web application firewalls and rate limiting measures. Database access controls should be reviewed and restricted to minimize potential damage from successful exploitation attempts. The vulnerability aligns with CWE-89 which specifically addresses sql injection flaws in software applications, and represents a clear violation of the principle of least privilege in database access management. From an att&ck framework perspective, this vulnerability maps to initial access and credential access tactics where adversaries can leverage unauthenticated api endpoints to gain unauthorized database access and extract sensitive information. Organizations should conduct thorough security assessments of their wordpress installations to identify other potential sql injection vulnerabilities and ensure proper input validation across all custom api endpoints.