CVE-2026-12800 describes an SQL Injection vulnerability in the Premium Packages – Sell Digital Products Securely WordPress plugin (codename065). The vulnerability exists in the CouponCodes::find() method, where the 'code' parameter from a POST request to the REST API endpoint /wp-json/wpdmpp/v1/cart/coupon is used directly in a raw SQL query without proper escaping or use of $wpdb->prepare() or esc_sql(). This allows unauthenticated remote attackers to append additional SQL queries, potentially extracting sensitive data from the database. The vulnerability affects all versions up to and including 6.2.0. The CVSS v3.1 base score is 7.5 (High), with an attack vector of network, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact. No official patch or remediation level is currently documented.

An unauthenticated attacker can exploit this SQL Injection vulnerability to extract sensitive information from the WordPress database used by the Premium Packages plugin. The vulnerability impacts confidentiality but does not affect integrity or availability. Exploitation could lead to disclosure of sensitive data stored in the database, potentially including user or transactional information managed by the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable REST API endpoint if possible. Monitoring for unusual activity targeting this endpoint is advisable. Avoid using the affected plugin versions in production environments where sensitive data is handled.