The Premium Packages – Sell Digital Products Securely plugin for WordPress contains a flaw allowing unauthenticated users to inject SQL through the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST endpoint. Because this parameter is concatenated directly into a SQL statement without proper escaping, an attacker can append arbitrary SQL statements. This vulnerability can be exploited to read sensitive data from the database and potentially perform other database operations that compromise confidentiality and integrity of site data.

WordPress sites using the Premium Packages plugin, any version up to and including 6.2.0. The affected component is the CouponCodes library and the MiniCartAPI REST endpoint.

The CVSS score of 7.5 indicates high severity, while the EPSS score of < 1% suggests a low likelihood of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Because the REST endpoint is publicly accessible, any visitor to the site can exploit the flaw without authentication, making the attack vector remote and straightforward.