VulnSocial

CVE-2026-12800PoC

LOWCVSS 7.5 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Prioritize remediation for affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied parameter, which is interpolated directly into a raw SQL query string in the CouponCodes::find() method without use of $wpdb->prepare() or esc_sql(). This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Back to dashboard
3.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-89

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

  • Public PoC and exploit tooling are both present
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-07-28); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-07-28: 1Mentions · 2026-10-22: 1PoC Mentioned / Linked · 2026-07-28: 1Exploit Tool / Code · 2026-07-28: 1Technical Details · 2026-07-28: 1Technical Details · 2026-10-22: 107-2810-22
Signal classification2 categories
PoC
150.0%
Disclosure
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-07-281
PoC1
2026-10-221
Disclosure1
Full discourse2 posts
  • pdnuclei-bot@pdnuclei_bot
    Disclosure

    🚨 CVE-2026-12800 - high 🚨 Premium Packages – Sell Digital Products Securely - SQL Injection > Premium Packages – Sell Digital Products Securely WordPress plugin <= 6.2.0 contains ... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-12800 @pdnuclei #NucleiTemplates #cve

    Post summary

    The text announces CVE-2026-12800 as a high-severity SQL Injection vulnerability in a WordPress plugin, referencing a ProjectDiscovery library entry and Nuclei templates, but provides no exploit, PoC, patch, or active exploitation details.

    12021340
    1.4K followersView on X
  • ekofyi@ekofyi
    PoC

    Calling a REST endpoint “secure” because it requires no login but uses a coupon code field to filter is peak WordPress plugin logic. Here’s how that field becomes a SQL injection vector that dumps the entire DB. https://ekofyi.com/blog/cve-2026-12800-premium-packages-sql-injection

    Post summary

    The post outlines a SQLi vulnerability (CVE‑2026‑12800) in a WordPress plugin and provides a PoC via the linked article, but offers no evidence of active exploitation or patches.

    0000057
    170 followersView on X

Explore more

Back to dashboard