CVE-2026-12800

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied parameter, which is interpolated directly into a raw SQL query string in the CouponCodes::find() method without use of $wpdb->prepare() or esc_sql(). This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

• CWE-89

• https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/6.2.0/includes/libs/CouponCodes.php#L26
• https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/6.2.0/includes/libs/CouponCodes.php#L82
• https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/6.2.0/includes/libs/MiniCartAPI.php#L398
• https://plugins.trac.wordpress.org/changeset/3595291/wpdm-premium-packages
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b288386c-709c-49a6-9b46-28bf46c3c303?source=cve

Published

Jul 28, 2026

Last Modified

Jul 28, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12795A vulnerability was determined in BerriAI litellm up to 1.82…7.3
• CVE-2026-12796A vulnerability was identified in BerriAI litellm up to 1.82…6.3
• CVE-2026-12797A security flaw has been discovered in BerriAI litellm up to…6.3
• CVE-2026-12798A weakness has been identified in BerriAI litellm up to 1.82…6.3
• CVE-2026-12799A security vulnerability has been detected in BerriAI litell…4.3
• CVE-2026-1280The Frontend File Manager Plugin for WordPress is vulnerable…7.5
• CVE-2026-12801The Ultra Addons for Contact Form 7 plugin for WordPress is …6.4
• CVE-2026-12802In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData…8.7
• CVE-2026-12803In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC d…8.7
• CVE-2026-12804A vulnerability was detected in lemonldap-ng up to 2.23.0. I…4.3
• CVE-2026-12805A flaw has been found in OFFIS DCMTK up to 3.7.0. The affect…6.3
• CVE-2026-12806A vulnerability has been found in Edimax BR-6478AC V2 1.23. …8.8