CVE-2026-61948
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
The WPDM – Premium Packages plugin versions up to 6.2.0 are vulnerable to unauthenticated SQL injection.
Risk Assessment
An unauthenticated attacker can execute arbitrary SQL queries, potentially leading to data leakage or modification.
Recommendation
It is recommended to update the WPDM – Premium Packages plugin to a version later than 6.2.0.
Other vulnerabilities in WPDM – Premium Packages
See all- CVE-2026-73190High
The WPDM – Premium Packages plugin (W3 Eden) is vulnerable to DOM-Based Cross-site Scripting (XSS) due to improper neutralization of input during web page generation. This issue affects WPDM – Premium Packages from n/a through 7.0.5.
- CVE-2026-61943High
The WPDM – Premium Packages plugin up to version 6.2.0 contains an unauthenticated Broken Access Control vulnerability. An unauthenticated attacker can bypass authorization mechanisms and gain unauthorized access to functions or data.
Original NVD description (English source)
Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS