External risk intelligence

WPDM Premium Packages SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-61948

The vulnerability exists in a WordPress plugin. WordPress plugins are typically deployed as part of public-facing web applications, making the code paths reachable by any user accessing the website over the internet.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security issue has been identified in a widely used WordPress plugin that handles premium packages. This vulnerability, if exploited, could allow unauthorized access to sensitive data stored within the database. The primary concern at this time is to confirm if this specific plugin is in use and, if so, to understand the potential exposure.

Unauthenticated data access flaw in a WordPress plugin.
Crucial to confirm if this plugin is in use.
Focus on confirming relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted SQL queries to a website using the affected plugin. This bypasses the need for any login credentials, potentially allowing unauthorized access to the website's database. The vulnerability can lead to sensitive data exposure and limited system disruption.

Unauthenticated network access required.
SQL injection through plugin input.
Data exposure and service disruption.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated attackers could exploit this vulnerability to inject malicious SQL commands into the WPDM – Premium Packages plugin, potentially leading to unauthorized access to sensitive database information when supported by the advisory.

Database information
Unauthenticated SQL injection
Unauthorized data access

Operational Fix

Recommended remediation, mitigation, and detection steps

This unauthenticated SQL injection vulnerability in WPDM – Premium Packages affects applications using the plugin. Responsibility likely falls to the application owner or the team managing the WordPress instance, in coordination with security or infrastructure teams. The first practical step is to identify all instances of the affected plugin, confirm their exposure to the internet, and assess business criticality to prioritize remediation efforts.

Application owners should own the remediation.
Verify plugin instances and internet exposure.
Plan for vendor coordination and patching.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WPDM – Premium Packages plugin?

WPDM – Premium Packages is a WordPress plugin designed to manage and deliver digital goods or protected files on a website. It provides tools for site administrators to handle downloads, set access permissions for premium content, and manage customer purchases. Because it integrates directly with the WordPress database to track files and user access, the plugin handles sensitive information that needs to be protected from unauthorized database queries.

What does SQL injection mean for CVE-2026-61948?

This vulnerability is classified as CWE-89, which refers to improper neutralization of special elements used in an SQL command. In plain terms, the plugin fails to properly validate input before sending it to the database. This allows an attacker to manipulate the underlying database commands, potentially tricking the system into revealing information that should otherwise be restricted or hidden.

How can an attacker trigger this vulnerability?

An attacker triggers this flaw by sending specially crafted network requests that contain malicious SQL code directed at the plugin. This does not require the attacker to have an existing account, administrative access, or any pre-established trust with the website. Simply visiting the site or interacting with specific plugin features is sufficient, provided the attacker knows how to format the input to influence the database.

Is my website at risk from this CVE?

According to Halo Surface Signal, this vulnerability is considered a likely risk because it exists within a WordPress plugin. Since these plugins are typically part of public-facing web applications, the vulnerable code paths are often reachable by anyone on the internet. If your WordPress site is accessible online and uses an affected version of this plugin, it is exposed to potential unauthorized database access.

Do I need to take action if I use this plugin?

Yes. Your first step should be to confirm if you are running a version of the plugin up to and including 6.2.0. Once you verify the presence of the plugin, determine its criticality to your site operations and ensure you are prepared to apply updates provided by the vendor. Prioritize this based on the fact that the vulnerability allows unauthenticated access, meaning immediate attention is necessary to secure your database.

References

patchstack.com/database/wordpress/plugin/wpdm-premium-packages/vulne…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.