If you received an email from me pointing you to this page, it is because your website appears to be running a vulnerable version of Premium Packages (the WordPress plugin wpdm-premium-packages, a WordPress Download Manager add-on by Shahjada / wpdownloadmanager.com). This page explains why that matters and how to fix it.

This notice concerns CVE-2026-15348, an unauthenticated authentication bypass in the plugin’s download handler that could let an unauthorized visitor log in as a customer or other non-admin account on your store. It affects versions 4.7.0 through 7.0.4 and is fixed in 7.0.5. If you are running an affected version, update Premium Packages to 7.0.5 or later.

A word on urgency, because it sits between my other notices: this issue needs no login at all (it is fully unauthenticated), so updating promptly is worthwhile. At the same time, it is an account-access flaw affecting non-admin order owners, not a server or full-admin takeover, and there is no indication that it is being exploited (it is not in CISA’s Known Exploited Vulnerabilities catalog, and I am aware of no exploitation reports). This page is a precautionary heads-up, not an incident report. Updating closes the issue, and no emergency response is implied.

This is a plugin flaw, not a WordPress core flaw. A fully up-to-date WordPress does not protect you if the Premium Packages plugin itself is on an affected version.

Is this message legitimate?

Yes. This is a good-faith, responsible-disclosure notice from an independent security researcher. I am not asking you for money, passwords, or access to your site, and I have not attempted to break into it, upload anything, or exploit anything.

All I did was look at publicly visible files that your website serves to every visitor (the same way your homepage is public) and note the version information that the Premium Packages plugin publishes in its public readme.txt file. I specifically did not touch the vulnerable endpoint, and nothing about this check touches your data, your admin area, or any private part of your site (more detail under What I did and did not do below).

If you would like to verify who I am, see the contact details at the bottom of this page and the About page.

Why this matters

Premium Packages is a WordPress Download Manager add-on (around 2,000 active installs) that lets a site sell digital products and downloads. In affected versions, the plugin’s download() handler runs on an unauthenticated request. It decodes an attacker-controlled URL parameter (wpdmppdl) that is only base64-encoded, with no signature and no nonce to prove the request is genuine, and then issues WordPress login cookies after a “domain” check whose both sides are attacker-supplied (so the check is trivially satisfied). This class of mistake is an authentication bypass: a side path hands out a logged-in session without ever verifying who is asking.

The practical effect is that an unauthenticated visitor could log in as any non-admin user who owns an order on the store: a customer, subscriber, author, editor, or shop-manager account. To be clear about the ceiling on this: it does not grant administrator access, and it does not by itself hand an attacker your server. It is account takeover of non-admin order owners.

The issue was not assigned a CVSS score by the assigning authority, so I will not attach a number to it; qualitatively it is serious because it needs no login, but bounded because the access it yields is non-admin. If my email cited this issue, it means the version your site reports falls within the affected range. I did not test whether your particular site is exploitable, only that it reports an affected version.

The good news: updating to the fixed version closes the issue, and the update is straightforward.

Am I affected? How to check your version

This is the one part of this notice that differs from the others I send, because this plugin’s public version fields are unreliable, so it is worth reading carefully.

The authoritative check is the WordPress admin area. This shows the real installed version:

  1. Log in to your WordPress dashboard (usually at yourdomain.com/wp-admin).
  2. Go to Plugins then Installed Plugins.
  3. Find Premium Packages and note the version shown beneath its name.

Then apply this rule, and note that versions compare numerically, not alphabetically:

  • Any version below 7.0.5: affected, update now.
  • 7.0.5 or newer: already fixed.

Why not just read the public files? Because for this plugin they can mislead you:

  • The plugin’s public readme.txt “Stable tag:” line lags its own code. A site running the last vulnerable release (7.0.4) publishes Stable tag: 7.0.3, for example. So the public readme is a reliable signal of “fixed” only when it reads 7.0.5 or higher. A lower number does not reliably tell you your exact release; treat anything below 7.0.5 as “check wp-admin and update.”
  • Do not judge your version from the ?ver= number on the plugin’s script or style URLs. The plugin froze its internal version constant at 7.0.4 in the 7.0.5 security release, so a patched 7.0.5 site still serves assets tagged ?ver=7.0.4; and the CSS file’s ?ver= is actually the WordPress-core version, not the plugin’s. Neither reflects the plugin’s real version. Use wp-admin.

How to upgrade

The safest path is to update through WordPress itself, and to back up first:

  1. Back up your site (files and database) before making changes. Most hosting providers offer one-click backups, or use a WordPress backup plugin.
  2. In the WordPress admin, go to Dashboard then Updates, or Plugins then Installed Plugins. If a Premium Packages update is listed, install it from here.
  3. If you prefer the command line, WP-CLI does the same thing: wp plugin update wpdm-premium-packages.
  4. If no update appears, you can get the latest release directly from the plugin’s page on the WordPress.org directory, Premium Packages, and update via Plugins then Add New Plugin then Upload Plugin.
  5. After updating, confirm the new version number (7.0.5 or later) in Plugins then Installed Plugins using the steps above, and check that your downloads and store features work normally.

While you are in there, it is worth confirming that WordPress core, WordPress Download Manager, and your other plugins are up to date, since the same principle applies to all of them.

After updating

Updating to 7.0.5 or later closes the issue, and for most sites that is the whole task. There is no indication this flaw has been exploited, so no emergency response is implied: you do not need to treat your site as compromised, take it offline, or force password resets.

Because the flaw could let an unauthorized visitor act on a customer or other non-admin account, one routine follow-up is sensible: have a look over recent customer-account and order activity for anything unfamiliar, for example orders or account changes that a customer did not make, or logins that do not line up with normal activity. Treat this as ordinary housekeeping of the kind a store does periodically, not as incident response. If something does look wrong, the usual steps apply (reset that account’s password and review the activity with the customer), and you are welcome to contact me with questions.

What I did and did not do

To be fully transparent about the check behind my email: I only read public files that your site already serves to every visitor, specifically the plugin’s public readme.txt file and your homepage. I did not access your WordPress admin area, your database, or any private part of the site. In particular, I did not touch the vulnerable endpoint, and I did not test or exploit anything.

This is a version-based observation: your site reports a version in the affected range. A site in that range may already be mitigated by other means (for example a web application firewall, or a backported fix), so this notice is not a statement that your site was exploitable at the time I checked.

I do not have a webmaster / I am stuck

If you are not the person who maintains the site, please forward this page to whoever does (your web developer, agency, or hosting provider). They will recognize the steps above quickly.

If you are maintaining the site yourself and get stuck, I am happy to help point you in the right direction at no cost. Reach out using the contact details below.

Contact

Evan Harris, Security Researcher

I reach out about issues like this purely to help operators secure their sites. If you would prefer not to be contacted again, just let me know and I will honor that.

References

Official advisories and tracking

Vendor / plugin