CVE-2026-12800

Name of the Vulnerable Software and Affected Versions Premium Packages – Sell Digital Products Securely versions prior to 6.2.1

Description An issue exists where unauthenticated attackers can append additional SQL queries to existing ones to extract sensitive information from the database. This occurs because the code parameter of the POST '/wp-json/wpdmpp/v1/cart/coupon' REST API endpoint is interpolated directly into a raw SQL query string within the CouponCodes::find() method without proper escaping or the use of $wpdb->prepare() or esc sql().

Recommendations Update the plugin to a version later than 6.2.0. As a temporary mitigation, restrict access to the '/wp-json/wpdmpp/v1/cart/coupon' endpoint or avoid using the code parameter until the update is applied.