CVE-2026-12800

🗓️ 28 Jul 2026 08:34:36Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 54 Views🌐 WEB

Unauthenticated SQL injection in Premium Packages plugin up to 6.2.0 via code parameter.

Reporter	Title	Published	Views	Family All 9
attackerkb	CVE-2026-12800	28 Jul 202608:34	–	attackerkb
Circl	CVE-2026-12800	28 Jul 202611:29	–	circl
Cvelist	CVE-2026-12800 Premium Packages <= 6.2.0 - Unauthenticated SQL Injection	28 Jul 202608:34	–	cvelist
EUVD	EUVD-2026-49723	28 Jul 202608:34	–	euvd
NVD	CVE-2026-12800	28 Jul 202609:16	–	nvd
Patchstack	WordPress Premium Packages – Sell Digital Products Securely plugin <= 6.2.0 - Unauthenticated SQL Injection vulnerability	31 Jul 202608:07	–	patchstack
Positive Technologies	PT-2026-65412	28 Jul 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-12800: Improper Neutralization of Special Elements used in an SQL Command	28 Jul 202600:00	–	rapid7
Vulnrichment	CVE-2026-12800 Premium Packages <= 6.2.0 - Unauthenticated SQL Injection	28 Jul 202608:34	–	vulnrichment

Vulners

Node

codename065 download_managerRange≤6.2.0wordpress

[
  {
    "vendor": "codename065",
    "product": "Premium Packages – Sell Digital Products Securely",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "6.2.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/6.2.0/includes/libs/CouponCodes.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/b288386c-709c-49a6-9b46-28bf46c3c303
plugins	www.plugins.trac.wordpress.org/changeset/3595291/wpdm-premium-packages
plugins	www.plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/6.2.0/includes/libs/MiniCartAPI.php
plugins	www.plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/6.2.0/includes/libs/CouponCodes.php

Parameter	Position	Path	Description	CWE
code	request body	/wp-json/wpdmpp/v1/cart/coupon	SQL Injection via unsafely interpolated user input in CouponCodes::find(), where the code parameter is interpolated directly into a raw SQL query without proper escaping or parameterization, allowing unauthenticated attackers to append additional SQL queries to extract data.	CWE-89

28 Jul 2026 16:07Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.5

EPSS0.00505

SSVC

CWE-89