Description

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.0.4 via the `wpdmppdl` parameter. This is due to the `download()` function — hooked to the unauthenticated WordPress `wp` action — decoding the attacker-controlled `wpdmppdl` parameter using only `base64_decode()` and `json_decode()` with no HMAC, cryptographic signature, or nonce verification, and then issuing WordPress authentication cookies after a domain check that is trivially bypassed because both sides of the comparison are attacker-supplied values. This makes it possible for unauthenticated attackers to authenticate as any non-administrator WordPress user, including subscribers, customers, contributors, authors, editors, and shop managers, who owns an order, gaining full session-level access to that account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-07-23T10:16:50.303Z",
  "pubdate": "2026-07-23T10:16:50.303Z",
  "executiveSummary": "The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to an authentication bypass vulnerability affecting all versions up to, and including, 7.0.4.\nThe flaw allows unauthenticated remote attackers to forge valid authentication cookies and hijack user sessions.\nThe vulnerability resides in the insecure processing of the attacker-controlled wpdmppdl parameter within the download() function, which is hooked directly to the unauthenticated WordPress wp action.\nDue to a complete lack of cryptographic signature validation, HMAC verification, or nonce checks, attackers can craft arbitrary encoded payloads to impersonate any non-administrator WordPress user who owns an order, including subscribers, customers, contributors, authors, editors, and shop managers.\nSuccessful exploitation grants attackers full session-level access to targeted accounts, allowing unauthorized access to sensitive user data, order histories, and role-specific dashboard capabilities.\nThis vulnerability introduces severe risk to confidentiality and integrity by exposing user accounts to unauthorized access without requiring prior credentials or interaction.",
  "technicalDetails": "The vulnerability is caused by insecure cryptographic design and improper input validation in the download() function of the Premium Packages – Sell Digital Products Securely plugin.\nThe download() function is hooked to the unauthenticated WordPress wp action, exposing it directly to external network requests.\nThe function extracts the attacker-controlled wpdmppdl parameter from the HTTP request and processes it using only base64_decode() followed by json_decode().\nCrucially, the implementation fails to implement HMAC verification, cryptographic signatures, or nonce validation to ensure the integrity and authenticity of the decoded payload data.\nFollowing the insecure decoding process, the application performs a domain check to validate the origin or context of the request; however, this check is fundamentally flawed because both sides of the comparison are derived from attacker-supplied values, allowing trivial bypasses.\nUpon passing the flawed domain validation, the application programmatically issues valid WordPress authentication cookies associated with the target user referenced in the payload.\nThe attack flow proceeds as follows: an unauthenticated attacker crafts a malicious request containing a specially constructed payload passed via the wpdmppdl parameter.\nThe payload specifies a targeted non-administrator user account, such as a customer or shop manager, who owns a valid order within the system.\nThe vulnerable download() function decodes the payload without cryptographic verification, evaluates the attacker-controlled domain comparison as true, and subsequently generates and returns valid WordPress authentication cookies.\nThe attacker captures these cookies, gaining full session-level access to the victim's account.\nThe affected component is the download() function within all versions of the Premium Packages – Sell Digital Products Securely plugin up to and including 7.0.4.\nNo authentication or privilege requirements are needed to initiate the attack, and the vector is accessible over the network to any unauthenticated user."
}