CyberRota Analysis
AI-GeneratedThe Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to an authentication bypass that allows unauthenticated attackers to impersonate any non-administrator user by exploiting the `wpdmppdl` parameter. This vulnerability arises from inadequate validation in the `download()` function, which can be manipulated to issue authentication cookies without proper security checks. WordPress site administrators using this plugin should prioritize patching to prevent unauthorized access to user accounts.
Original NVD Description
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.0.4 via the `wpdmppdl` parameter. This is due to the `download()` function — hooked to the unauthenticated WordPress `wp` action — decoding the attacker-controlled `wpdmppdl` parameter using only `base64_decode()` and `json_decode()` with no HMAC, cryptographic signature, or nonce verification, and then issuing WordPress authentication cookies after a domain check that is trivially bypassed because both sides of the comparison are attacker-supplied values. This makes it possible for unauthenticated attackers to authenticate as any non-administrator WordPress user, including subscribers, customers, contributors, authors, editors, and shop managers, who owns an order, gaining full session-level access to that account.