CVE-2026-93511 - Vulnerability Details - OpenCVE

The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription notifications, allowing unauthenticated attackers to forge payment confirmations and subscription-cancellation events against any order whose transaction id they know.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Wordpress-extensions	Premium Packages

No data.

No data.

References

Link	Providers
https://wpscan.com/vulnerability/edc2f15c-a72b-47c2-ad38-e6f5a8441d72/

History

Mon, 28 Sep 2026 20:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Wordpress-extensions Wordpress-extensions premium Packages
Vendors & Products		Wordpress-extensions Wordpress-extensions premium Packages

Wed, 23 Sep 2026 11:45:00 +0000

Type	Values Removed	Values Added
Description		The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription notifications, allowing unauthenticated attackers to forge payment confirmations and subscription-cancellation events against any order whose transaction id they know.
Title		Premium Packages < 7.2.1 - Unauthenticated PayPal Webhook Signature Verification Bypass
Weaknesses		CWE-290
References		https://wpscan.com/vulnerability/edc2f15c-a72b-47c2-ad38-e6f5a8441d72/
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2026-09-23T06:00:23.725Z

Updated: 2026-09-23T10:50:45.700Z

Reserved: 2026-09-18T08:45:53.297Z

Link: CVE-2026-93511

Vulnrichment

Updated: 2026-09-23T10:32:19.279Z

NVD

Status : Deferred

Published: 2026-09-23T06:17:06.163

Modified: 2026-09-23T18:12:32.050

Link: CVE-2026-93511

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-93511", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-09-18T08:45:53.297Z", "datePublished": "2026-09-23T06:00:23.725Z", "dateUpdated": "2026-09-23T10:50:45.700Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-09-23T06:00:23.725Z"}, "title": "Premium Packages < 7.2.1 - Unauthenticated PayPal Webhook Signature Verification Bypass", "problemTypes": [{"descriptions": [{"description": "CWE-290 Authentication Bypass by Spoofing", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "Premium Packages", "versions": [{"status": "affected", "versionType": "semver", "version": "7.0.0", "lessThan": "7.2.1"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription notifications, allowing unauthenticated attackers to forge payment confirmations and subscription-cancellation events against any order whose transaction id they know."}], "references": [{"url": "https://wpscan.com/vulnerability/edc2f15c-a72b-47c2-ad38-e6f5a8441d72/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Farid Narimanov", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-290", "lang": "en", "description": "CWE-290 Authentication Bypass by Spoofing"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-09-23T10:36:07.526399Z", "id": "CVE-2026-93511", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-23T10:50:45.700Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-93511", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-23T10:36:07.526399Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-290", "description": "CWE-290 Authentication Bypass by Spoofing"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-23T10:32:19.279Z"}}], "cna": {"title": "Premium Packages < 7.2.1 - Unauthenticated PayPal Webhook Signature Verification Bypass", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Farid Narimanov"}, {"lang": "en", "type": "coordinator", "value": "WPScan"}], "affected": [{"vendor": "Unknown", "product": "Premium Packages", "versions": [{"status": "affected", "version": "7.0.0", "lessThan": "7.2.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://wpscan.com/vulnerability/edc2f15c-a72b-47c2-ad38-e6f5a8441d72/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "x_generator": {"engine": "WPScan CVE Generator"}, "descriptions": [{"lang": "en", "value": "The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription notifications, allowing unauthenticated attackers to forge payment confirmations and subscription-cancellation events against any order whose transaction id they know."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-290 Authentication Bypass by Spoofing"}]}], "providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-09-23T06:00:23.725Z"}}}, "cveMetadata": {"cveId": "CVE-2026-93511", "state": "PUBLISHED", "dateUpdated": "2026-09-23T10:50:45.700Z", "dateReserved": "2026-09-18T08:45:53.297Z", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "datePublished": "2026-09-23T06:00:23.725Z", "assignerShortName": "WPScan"}, "dataVersion": "5.2"}