The Premium Packages WordPress plugin fails to verify the signature of PayPal webhook notifications for versions prior to 7.2.1, creating a situation in which an unauthenticated attacker can submit crafted notifications that appear to originate from PayPal. Because the plugin trusts any payload that contains a known transaction identifier, an attacker who learns a transaction ID can impersonate PayPal and trigger both payment confirmations and subscription cancellations. The weakness falls under CWE‑290, illustrating the absence of proper authentication for externally supplied data. The impact is that attacker‑controlled financial actions can be executed on behalf of a site owner without any user interaction, potentially draining funds, revoking legitimate subscriptions, or creating false billing records.

WordPress sites that use the Premium Packages plugin in any version earlier than 7.2.1 are affected. The plugin is identified as "Premium Packages" and is supplied by an unnamed vendor. Users should check the plugin version via the WordPress admin dashboard and ensure it is upgraded to 7.2.1 or later.

The CVSS score is 5.3, indicating medium severity. The EPSS score is less than 1%, suggesting a low likelihood of exploitation in the current threat landscape. This vulnerability is not listed in the CISA KEV catalog. However, because the attack requires only knowledge of a transaction ID, which may be publicly available or easily guessed, the practical risk depends on how often transaction IDs are disclosed by site administrators or are otherwise discoverable. The likely attack vector is an unauthenticated user crafting HTTP requests to the plugin’s webhook endpoint, passing an arbitrary transaction ID to influence payment status.