CVE-2026-15906

Name of the Vulnerable Software and Affected Versions Premium Packages – Sell Digital Products Securely versions prior to 7.0.5

Description This issue is a generic SQL Injection, which occurs when an attacker can interfere with the queries that an application makes to its database. Authenticated attackers with admin-level access and above can append additional SQL queries to existing ones to extract sensitive information from the database. This is caused by insufficient escaping of the user-supplied orderby parameter and a lack of sufficient preparation on the existing SQL query.

Recommendations Update Premium Packages – Sell Digital Products Securely to version 7.0.5 or later. As a temporary workaround, restrict access to the orderby parameter to minimize the risk of exploitation.