CVE-2026-93511 — Premium Packages < 7.2.1 - Unauthenticated PayPal Webhook Signature Verification Bypass

CVE-2026-93511

Premium Packages < 7.2.1 - Unauthenticated PayPal Webhook Signature Verification Bypass PUBLISHED

Description (CNA)

The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription notifications, allowing unauthenticated attackers to forge payment confirmations and subscription-cancellation events against any order whose transaction id they know.

Affected (CNA)

Vendor / product	Versions
Unknown / Premium Packages	affected 7.0.0 before 7.2.1

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/edc2f15c-a72b-47c2-ad38-e6f5a8441d72/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.