CVE-2026-118404
UnknownSummary
The Premium Packages WordPress plugin before 7.3.1 does not verify ownership or session binding when loading a previously saved shopping cart. This allows any unauthenticated user who obtains another shopper's saved-cart identifier to load that shopper's cart contents into their own session.
Risk Assessment
An attacker can view another shopper's cart contents, including selected products, quantities and buyer-entered custom field data.
Recommendation
Update the Premium Packages plugin to version 7.3.1 or later.
Other vulnerabilities in Premium Packages WordPress plugin
See all- CVE-2026-118407Unknown
The Premium Packages WordPress plugin before 7.3.1 does not verify that a user claiming a guest order is the original buyer. This allows any authenticated user to take ownership of any unclaimed guest order by supplying only the order identifier.
- CVE-2026-118403Unknown
The Premium Packages WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before returning its details. This allows unauthenticated visitors who know a guest order's identifier to view its order status, payment status and total.
Original NVD description (English source)
The Premium Packages WordPress plugin before 7.3.1 does not verify ownership or session binding when loading a previously saved shopping cart, allowing any unauthenticated user who obtains another shopper's saved-cart identifier to load that shopper's cart contents, including selected products, quantities and buyer-entered custom field data, into their own session.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS