CVE-2026-12800: WordPress Premium Packages SQLi Vulnerability

CVE-2026-12800 Overview

CVE-2026-12800 is an unauthenticated SQL Injection vulnerability in the Premium Packages – Sell Digital Products Securely plugin for WordPress. The flaw affects all versions up to and including 6.2.0. The plugin fails to properly escape the code parameter submitted to the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint. The parameter is interpolated directly into a raw SQL query inside the CouponCodes::find() method without $wpdb->prepare() or esc_sql(). Unauthenticated attackers can append additional SQL clauses to the query and extract sensitive data from the WordPress database. The vulnerability is classified under CWE-89 (SQL Injection).

Critical Impact
Unauthenticated remote attackers can extract sensitive data from the WordPress database through a public REST endpoint, exposing user credentials, session tokens, and order data.

Affected Products

Premium Packages – Sell Digital Products Securely plugin for WordPress
All versions up to and including 6.2.0
Vulnerable component: CouponCodes::find() method invoked via MiniCartAPI REST route

Discovery Timeline

2026-07-28 - CVE-2026-12800 published to the National Vulnerability Database (NVD)
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-12800

Vulnerability Analysis

The vulnerability resides in the coupon validation path of the plugin's mini cart REST API. When a client submits a POST request to /wp-json/wpdmpp/v1/cart/coupon, the handler in MiniCartAPI.php forwards the code parameter into CouponCodes::find(). That method builds a raw SQL string by concatenating the untrusted input directly into the query. The plugin uses neither $wpdb->prepare() with placeholders nor esc_sql() to sanitize the value before execution.

Because the REST route does not require authentication, any anonymous internet user can reach the vulnerable code path. Attackers can craft payloads that terminate the intended query and append UNION SELECT statements or stacked conditions to read arbitrary tables, including wp_users password hashes and session data stored in wp_usermeta.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command. The code value from the JSON request body is concatenated into a query string in CouponCodes.php at the coupon lookup logic. WordPress provides $wpdb->prepare() for parameterized queries, but the plugin bypasses that API. This design decision converts every user-supplied coupon code into a potential SQL fragment.

Attack Vector

Exploitation requires only network access to the WordPress site. No authentication, user interaction, or elevated privileges are needed. An attacker sends a JSON POST request to the plugin's coupon REST endpoint with a malicious code value containing SQL syntax. The server executes the injected clause against the WordPress database and returns results reflected through the API response or observable via time-based inference. See the Wordfence Vulnerability Analysis and the vulnerable code at CouponCodes.php line 26 and line 82 for technical details.

Detection Methods for CVE-2026-12800

Indicators of Compromise

POST requests to /wp-json/wpdmpp/v1/cart/coupon containing SQL metacharacters such as single quotes, UNION, SELECT, SLEEP(, or comment sequences (--, #) in the code JSON field
Unusual response time variance on the coupon endpoint indicating time-based blind SQL injection attempts
Web server logs showing high volumes of coupon endpoint requests from a single source
Unexpected SELECT queries against wp_users or wp_options originating from the WordPress PHP process

Detection Strategies

Deploy WAF signatures that inspect JSON request bodies to the wpdmpp/v1/cart/coupon route for SQL injection patterns
Enable MySQL general query logging on staging or high-value production sites and alert on queries containing UNION or information_schema references from the coupon workflow
Monitor WordPress REST API traffic for anomalous request rates and payload sizes against plugin endpoints

Monitoring Recommendations

Track error rates and 500 responses from the /wp-json/wpdmpp/ namespace, which often accompany SQL injection probing
Log outbound database queries containing sleep(, benchmark(, or information_schema to catch data exfiltration attempts
Correlate authentication anomalies with prior REST API activity from the same source IP to identify credential theft following successful injection

How to Mitigate CVE-2026-12800

Immediate Actions Required

Update the Premium Packages – Sell Digital Products Securely plugin to a version above 6.2.0 that includes the fix from Changeset #3595291
Audit wp_users and wp_usermeta for unexpected changes and force password resets if exploitation is suspected
Rotate WordPress secret keys and salts in wp-config.php after patching
Review web server and database logs for indicators of prior exploitation dating back to the plugin's installation

Patch Information

The vendor addressed the vulnerability in Changeset #3595291, which introduces proper parameterization of the code value in CouponCodes::find(). Site administrators should install the latest release from the WordPress plugin repository. Verify the update by confirming the plugin version reported in the WordPress admin dashboard is greater than 6.2.0.

Workarounds

Block or rate-limit access to /wp-json/wpdmpp/v1/cart/coupon at the web server or WAF layer until patching is complete
Deactivate the Premium Packages plugin if immediate patching is not feasible and coupon functionality is non-critical
Restrict REST API access to the plugin namespace using an allowlist filter in functions.php or a security plugin

bash

# Example nginx location block to temporarily block the vulnerable endpoint
location = /wp-json/wpdmpp/v1/cart/coupon {
    return 403;
}