CVE-2026-15348 is an authentication bypass vulnerability in the Premium Packages – Sell Digital Products Securely WordPress plugin. The issue exists in the download() function, which is hooked to the unauthenticated WordPress wp action. It decodes the wpdmppdl parameter using base64_decode() and json_decode() without any cryptographic verification such as HMAC, signature, or nonce. The domain check intended to validate the parameter is trivially bypassed because both sides of the comparison are attacker-controlled. Consequently, attackers can authenticate as any non-administrator user who owns an order, gaining full session-level access to that user's account. This affects all plugin versions up to and including 7.0.4.

An unauthenticated attacker can bypass authentication controls and impersonate any non-administrator WordPress user who owns an order. This grants full session-level access to that user's account, potentially allowing unauthorized access to customer data, order information, and other user-specific content. The vulnerability impacts confidentiality, integrity, and availability at a limited scope (non-administrator accounts).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch has been documented at this time. Until a patch is available, users should consider disabling the affected plugin or restricting access to the download functionality. Monitor vendor channels for updates and apply official patches promptly once released.