Summary
CVE-2026-12800 is a high-severity unauthenticated SQL injection vulnerability in the Premium Packages – Sell Digital Products Securely WordPress plugin (wpdm-premium-packages), affecting all versions up to and including 6.2.0. The flaw allows any unauthenticated remote attacker to inject arbitrary SQL via the plugin’s coupon REST API endpoint and extract sensitive data from the WordPress database. It carries a CVSS v3.1 base score of 7.5 (High).
Technical details
- Root cause: The
CouponCodes::find()method interpolates the user-suppliedcodeparameter directly into a raw SQL query string without use of WordPress’s$wpdb->prepare()oresc_sql()sanitization functions, leaving the input unsanitized. - Trigger conditions: An unauthenticated HTTP POST request to the publicly accessible REST API endpoint
POST /wp-json/wpdmpp/v1/cart/couponwith a craftedcodeparameter value is sufficient to trigger the injection. - Attack vector: Network — no local access, authenticated session, or user interaction required. Attack complexity is LOW (AC:L).
- Impact: Successful exploitation enables an attacker to append additional SQL queries to existing ones, allowing full read access to the WordPress database. This can expose WordPress user credential hashes, customer PII, order records, payment metadata, and any other data stored in the database.
Affected software
- Premium Packages – Sell Digital Products Securely (wpdm-premium-packages) — all versions up to and including 6.2.0
Severity
- CVSS v3.1 Base Score: 7.5 (High)
- Vector String:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Mitigation and recommended actions
- Immediate action — update the plugin: Upgrade to version 7.0.5 (the current release as of 2026-07-17), which contains a complete codebase overhaul and is not affected by this vulnerability. Updates can be applied directly from the WordPress admin dashboard under Plugins → Updates.
- Verify exposure: Confirm whether the plugin is installed and active on any internet-facing WordPress instances. The plugin path
/wp-content/plugins/wpdm-premium-packages/and the REST API namespace/wp-json/wpdmpp/are externally observable and can be used to identify exposed assets. - If immediate patching is not possible: Consider blocking external access to the
/wp-json/wpdmpp/v1/cart/couponendpoint at the WAF or web server level as a temporary mitigation until the plugin can be updated.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

