https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 23:53:50 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-12800 <p>The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the &#39;code&#39; parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied parameter, which is interpolated directly into a raw SQL query string in the CouponCodes::find() method without use of $wpdb-&gt;prepare() or esc_sql(). This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.</p> <p>The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the &#39;code&#39; parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied parameter, which is interpolated directly into a raw SQL query string in the CouponCodes::find() method without use of $wpdb-&gt;prepare() or esc_sql(). This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-12800 https://vulnerability.circl.lu/vuln/ghsa-jqfx-7h8g-gj4q <p>The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the &#39;code&#39; parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied parameter, which is interpolated directly into a raw SQL query string in the CouponCodes::find() method without use of $wpdb-&gt;prepare() or esc_sql(). This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.</p> <p>The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the &#39;code&#39; parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied parameter, which is interpolated directly into a raw SQL query string in the CouponCodes::find() method without use of $wpdb-&gt;prepare() or esc_sql(). This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.</p> https://vulnerability.circl.lu/vuln/ghsa-jqfx-7h8g-gj4q