CVE-2026-15348: WordPress Premium Packages Auth Bypass

CVE-2026-15348 Overview

CVE-2026-15348 is an authentication bypass vulnerability in the Premium Packages – Sell Digital Products Securely plugin for WordPress. The flaw affects all versions up to and including 7.0.4. The download() function processes the attacker-controlled wpdmppdl parameter using only base64_decode() and json_decode(), with no HMAC, cryptographic signature, or nonce verification. A subsequent domain check compares two attacker-supplied values, making the guard trivially bypassable. Unauthenticated attackers can obtain WordPress session cookies for any non-administrator account tied to an order, including subscribers, customers, contributors, authors, editors, and shop managers.

Critical Impact
Unauthenticated attackers can impersonate any non-administrator WordPress account that owns an order, gaining full session-level access to customer, contributor, author, editor, and shop manager roles.

Affected Products

Premium Packages – Sell Digital Products Securely (WordPress plugin)
All versions up to and including 7.0.4
Deployments exposing the unauthenticated WordPress wp action hook

Discovery Timeline

2026-07-23 - CVE-2026-15348 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-15348

Vulnerability Analysis

The vulnerability is classified as Authentication Bypass [CWE-287]. The plugin registers a download() handler on the WordPress wp action, which fires on every front-end request without authentication. When the request contains a wpdmppdl parameter, the handler decodes it with base64_decode() followed by json_decode(). The decoded structure is treated as trusted input that identifies an order and the associated user.

Because the payload carries no HMAC, signature, or nonce, an attacker can craft arbitrary values. The plugin then performs a domain comparison intended to bind the token to the site, but both operands of the check originate from the attacker-supplied payload. The bypass allows the code path to reach the authentication step, where the plugin issues valid WordPress session cookies for the user ID contained in the forged blob.

Root Cause

The root cause is missing integrity verification on a serialized authentication token. Encoding is not authentication, yet the plugin treats a base64-encoded JSON blob as proof of identity. The subsequent domain guard fails because it validates attacker input against attacker input rather than against a server-side constant.

Attack Vector

Exploitation is remote and unauthenticated over the network. An attacker sends a single crafted HTTP request containing a forged wpdmppdl parameter targeting any front-end URL that triggers the wp action. The server responds by setting WordPress LOGGED_IN cookies for the specified account. Administrator accounts are excluded, but any customer, subscriber, author, editor, or shop manager holding an order can be impersonated.

No verified public exploit code is available. Technical details are referenced in the Wordfence Vulnerability Report and the WordPress Plugin Function Source.

Detection Methods for CVE-2026-15348

Indicators of Compromise

HTTP requests containing the wpdmppdl query or POST parameter with base64-encoded JSON payloads.
Unexpected Set-Cookie responses issuing wordpress_logged_in_* cookies from front-end URLs rather than wp-login.php.
WordPress session activity for customer, subscriber, or shop manager accounts originating from IP addresses with no prior login history.
Order-related account activity, profile changes, or downloads without a preceding successful login event in wp-login.php logs.

Detection Strategies

Inspect web server access logs for requests containing the wpdmppdl parameter and correlate with subsequent authenticated actions from the same source IP.
Alert on WordPress authentication cookies being issued outside of the standard wp-login.php code path.
Compare user session origins against historical login patterns to surface impersonation of low-privilege accounts.

Monitoring Recommendations

Forward WordPress and web server logs to a centralized analytics platform and retain them for correlation across requests and sessions.
Track plugin inventory and version drift for wpdm-premium-packages across all managed WordPress instances.
Monitor the Wordfence Vulnerability Report for updates to signatures and detection guidance.

How to Mitigate CVE-2026-15348

Immediate Actions Required

Update the Premium Packages – Sell Digital Products Securely plugin to a version later than 7.0.4 as soon as a fixed release is available.
If no patched version is available, deactivate and remove the plugin from all affected WordPress sites.
Invalidate existing WordPress sessions by rotating authentication salts in wp-config.php to force re-login of all non-administrator users.
Audit recent order activity, profile updates, and downloads for accounts other than administrators.

Patch Information

Refer to the WordPress Changeset Review for source-level fixes and to the Wordfence Vulnerability Report for tracked fixed versions. Verify the deployed plugin version on every site after upgrade.

Workarounds

Block HTTP requests containing the wpdmppdl parameter at a web application firewall until the plugin is patched or removed.
Restrict access to WordPress front-end endpoints from untrusted networks where feasible.
Enforce two-factor authentication for all non-administrator accounts to limit the value of hijacked sessions.

bash

# Example WAF rule (ModSecurity) to block exploitation attempts
SecRule ARGS:wpdmppdl ".+" \
    "id:1026153480,\
     phase:2,\
     deny,\
     status:403,\
     msg:'CVE-2026-15348 Premium Packages wpdmppdl parameter blocked'"