CVE-2023-4293: codename065 premium packages – sell digital products securely Improper Privilege Management

Vulnerability summary

CVE-2023-4293 is a high (CVSS 8.8) Improper Privilege Management vulnerability in codename065 premium packages – sell digital products securely. EPSS estimates a 0.99% chance of exploitation in the next 30 days, higher than 61.8% of scored vulnerabilities. 2 public exploits are recorded. Fixed in 5.7.5.

Timeline

1. 12-08-2023
   PublishedVulnerability first disclosed.
2. 08-04-2026
   Last modifiedVulnerability information updated.

Description

The Premium Packages - Sell Digital Products Securely plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.4 due to insufficient restriction on the 'wpdmpp_update_profile' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'profile[role]' parameter during a profile update.

• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.