CVE-2026-15348

The CVE affects the WordPress plugin Premium Packages – Sell Digital Products Securely up to version 7.0.4 . The vulnerability arises in the download() function, which is hooked to the unauthenticated WordPress wp action and decodes the attacker-controlled wpdmppdl parameter with only base64_deco...