Description

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-07-23T10:16:51.597Z",
  "pubdate": "2026-07-23T10:16:51.597Z",
  "executiveSummary": "An SQL injection vulnerability has been identified in the Premium Packages – Sell Digital Products Securely plugin for WordPress. The flaw specifically resides in the handling of the 'orderby' parameter across all versions up to, and including, 7.0.4. This security deficiency allows malicious actors with administrative privileges to manipulate underlying database queries through input that lacks adequate sanitization, escaping, and parameterized query construction. The primary impact of this vulnerability involves unauthorized database access, potentially exposing sensitive information stored within the WordPress database tables. Exploitation of this vulnerability requires authenticated access with administrative capabilities or higher. Consequently, the associated risk centers on privilege abuse and data exfiltration within compromised WordPress environments. Security teams must address this issue promptly to prevent malicious database manipulation and protect sensitive institutional or user data managed by the plugin.",
  "technicalDetails": "The vulnerability stems from improper neutralization of special elements used in an SQL command, commonly classified as SQL Injection (SQLi). Specifically, the flaw is triggered via the 'orderby' parameter processed by the Premium Packages – Sell Digital Products Securely plugin. The root cause of the vulnerability involves insufficient escaping mechanisms applied to user-supplied input combined with a lack of proper statement preparation within the existing database query construction logic. In vulnerable versions up to, and including, 7.0.4, the application directly concatenates or improperly interpolates the input from the 'orderby' parameter into the active SQL query string without enforcing strict whitelisting or robust parameterization. To exploit this vulnerability, an authenticated attacker possessing administrator-level access or higher must supply a specially crafted malicious payload via the 'orderby' parameter. The attack flow initiates when the administrative user issues an HTTP request containing the injected SQL payload directed at the vulnerable component of the plugin. Because the input lacks adequate escaping and the query is not securely prepared, the database management system interprets the injected string as executable SQL commands rather than literal data. This behavioral flaw permits the attacker to append arbitrary SQL fragments into the pre-existing query structure. The post-exploitation impact includes the potential extraction of sensitive information from the database through techniques such as UNION-based SQL injection or error-based data retrieval. The vulnerability requires administrative privileges, meaning an attacker must first compromise an administrative account or leverage an existing administrative session to interact with the vulnerable parameter. The vulnerable component operates within the context of the WordPress application server, exposing the underlying database management system to manipulation if administrative controls are bypassed or abused."
}