medium5.3
CVE-2026-93511
The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription notifications, allowin…
Impact
The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription notifications, allowing unauthenticated attackers to forge payment confirmations and subscription-cancellation events against any order whose transaction id they know.
Affected products
| Product | Affected versions |
|---|---|
| Premium Packages WordPress Plugin | before 7.2.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.