UNKNOWN NVD

CVE-2026-93511

The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription notifications, allowin

The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription notifications, allowing unauthenticated attackers to forge payment confirmations and subscription-cancellation events against any order whose transaction id they know.

References

https://wpscan.com/vulnerability/edc2f15c-a72b-47c2-ad38-e6f5a8441d72/

Published: 2026-09-23 · Source: NVD · Feed updated: 2026-09-23

This unknown severity vulnerability was published on 2026-09-23 via NVD.

vulnfeed aggregates 4195 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.