CVE-2026-93511
Received Received - Intake

Unauthenticated Webhook Signature Bypass in Premium Packages WordPress Plugin

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: WPScan

Description
The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription notifications, allowing unauthenticated attackers to forge payment confirmations and subscription-cancellation events against any order whose transaction id they know.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-93511
EUVD
EUVD-2026-85063

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
premium_packages wordpress_plugin to 7.2.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Premium Packages WordPress plugin before version 7.2.1 has a flaw where it does not verify PayPal's webhook signature. This allows unauthenticated attackers to forge payment confirmations and subscription-cancellation events if they know the transaction ID of any order.

Detection Guidance

Check the installed version of the Premium Packages WordPress plugin. If it is version 7.2.1 or earlier, the system is vulnerable. Look for unauthorized payment confirmations or subscription changes in logs.

Impact Analysis

Attackers could manipulate payment and subscription data without authentication, leading to unauthorized transactions or cancellations. This could result in financial loss, disrupted services, or unauthorized access to user accounts.

Compliance Impact

This vulnerability could lead to unauthorized data access or financial transactions, potentially violating GDPR (data protection) or HIPAA (health data privacy) by exposing sensitive user information or payment details.

Mitigation Strategies

Update the Premium Packages plugin to version 7.2.1 or later immediately. Review recent payment and subscription logs for signs of unauthorized activity. Consider revoking any suspicious transactions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93511. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart