The Premium Packages – Sell Digital Products Securely plugin for WordPress contains a flaw that allows an attacker who has no valid credentials to authenticate as any non‑administrator WordPress user. The vulnerability is a CWE‑287 Authentication Bypass flaw that arises because the download() function, fired during the unauthenticated wp action, decodes the attacker‑supplied wpdmppdl parameter with only base64_decode() and json_decode(), and then performs a domain check using values controlled by the attacker. After this trivial check, the function issues WordPress authentication cookies, giving the attacker full session‑level access to the chosen user account. This can lead to unauthorized data disclosure, modification, deletion, or abuse of any features that rely on that user's permissions.

WordPress sites that host the Premium Packages plugin by codename065, on any version up to and including 7.0.4. All installations that have not applied a later patch are susceptible, regardless of the site's size or the number of registered users.

The flaw has a CVSS score of 6.3, reflecting moderate severity. The EPSS score is reported as less than 1 %, indicating a low exploitation probability at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an unauthenticated attacker sending a crafted HTTP request containing a malicious wpdmppdl parameter to a download URL, bypassing the domain check and receiving authentication cookies for the targeted user. Because the attacker can impersonate any non‑admin role, the compromise can expose personal data and may facilitate further privilege escalation if the site contains additional vulnerabilities.