CVE-2026-15348

Name of the Vulnerable Software and Affected Versions Premium Packages – Sell Digital Products Securely versions prior to 7.0.5

Description An authentication bypass exists due to the download() function, which is hooked to the unauthenticated WordPress wp action. The function decodes the wpdmppdl parameter using base64 decode() and json decode() without employing HMAC, cryptographic signatures, or nonce verification. Furthermore, a domain check is performed using two attacker-supplied values, allowing it to be easily bypassed. This enables unauthenticated attackers to obtain authentication cookies and gain full session-level access to any non-administrator account that owns an order, such as subscribers, customers, contributors, authors, editors, and shop managers.

Recommendations Update the plugin to a version newer than 7.0.4. As a temporary mitigation, restrict access to the wpdmppdl parameter until the update is applied.