CVE-2026-61943
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
The WPDM – Premium Packages plugin up to version 6.2.0 contains an unauthenticated Broken Access Control vulnerability. An unauthenticated attacker can bypass authorization mechanisms and gain unauthorized access to functions or data.
Risk Assessment
The risk includes unauthorized access to sensitive functions or data, which may lead to confidentiality and integrity breaches.
Recommendation
Immediately update the WPDM – Premium Packages plugin to the latest available version that fixes this vulnerability.
Other vulnerabilities in WPDM – Premium Packages
See all- CVE-2026-61948Critical
The WPDM – Premium Packages plugin versions up to 6.2.0 are vulnerable to unauthenticated SQL injection.
- CVE-2026-73190High
The WPDM – Premium Packages plugin (W3 Eden) is vulnerable to DOM-Based Cross-site Scripting (XSS) due to improper neutralization of input during web page generation. This issue affects WPDM – Premium Packages from n/a through 7.0.5.
Original NVD description (English source)
Unauthenticated Broken Access Control in WPDM – Premium Packages <= 6.2.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS