CVE-2026-118403
UnknownSummary
The Premium Packages WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before returning its details. This allows unauthenticated visitors who know a guest order's identifier to view its order status, payment status and total.
Risk Assessment
An attacker can obtain information about guest orders, resulting in a confidentiality breach of order data.
Recommendation
Update the Premium Packages plugin to version 7.3.1 or later.
Other vulnerabilities in Premium Packages WordPress plugin
See all- CVE-2026-118407Unknown
The Premium Packages WordPress plugin before 7.3.1 does not verify that a user claiming a guest order is the original buyer. This allows any authenticated user to take ownership of any unclaimed guest order by supplying only the order identifier.
- CVE-2026-118404Unknown
The Premium Packages WordPress plugin before 7.3.1 does not verify ownership or session binding when loading a previously saved shopping cart. This allows any unauthenticated user who obtains another shopper's saved-cart identifier to load that shopper's cart contents into their own session.
Original NVD description (English source)
The Premium Packages WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before returning its details, allowing unauthenticated visitors who know a guest order's identifier to view its order status, payment status and total.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS