CVE-2026-61948
This vulnerability is an unauthenticated SQL injection in the WPDM – Premium Packages plugin for WordPress, affecting versions 6.2.0 and earlier. An attacker can inject malicious SQL commands without needing to log in, potentially exposing sensitive data. The flaw is critical due to its high confidentiality impact and ease of exploitation over the network.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
WPDM – Premium Packages plugin for WordPress, versions 6.2.0 and earlier.
Real-world impact
An attacker could read, modify, or delete database contents, leading to data theft or site compromise.
Why this severity
The CVSS score of 9.3 reflects that the flaw can be exploited remotely without authentication, with high confidentiality impact and low effort, making it a critical risk.
What to do about it
- ›Upgrade WPDM – Premium Packages to a version newer than 6.2.0 if available.
- ›If upgrade is not possible, disable or remove the plugin until a patch is released.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources