HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-12800 — The Premium Packages – Sell Digital Products Securely plugin for WordPress is vu...

·Source: NIST NVD

Updated:

Executive Summary

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied parameter, which is interpolated directly into a raw SQL query string in the CouponCodes::find() method witho

Analysis

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied parameter, which is interpolated directly into a raw SQL query string in the CouponCodes::find() method without use of $wpdb->prepare() or esc_sql(). This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVSS Score: 7.5. Published: 2026-07-28T09:16:40.667.

Indicators of Compromise (1)

CVE (1)
CVE-2026-12800
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 28, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

PNC Financial Services appoints CISO

The PNC Financial Services Group, Inc. (NYSE: PNC) announced today that Christian Winward has been named chief information security officer.

Finextra
MEDIUMVulnerabilityNEW

NVIDIA’s Open Secure AI Alliance Is Missing Some Big Names

NVIDIA has launched a new Open Secure AI Alliance to build an “open defense stack for agents”

Infosecurity Magazine
HIGHVulnerability

NVD HIGH: CVE-2026-14516 — The Online Scheduling and Appointment Booking System – Bookly plugin for WordPre...

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staff_ids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL qu

CVE-2026-14516
NIST NVD