CVE-2026-118407
UnknownSummary
The Premium Packages WordPress plugin before 7.3.1 does not verify that a user claiming a guest order is the original buyer. This allows any authenticated user to take ownership of any unclaimed guest order by supplying only the order identifier.
Risk Assessment
An attacker can access the buyer's billing details and download their purchased files, resulting in a confidentiality breach of customer data.
Recommendation
Update the Premium Packages plugin to version 7.3.1 or later.
Other vulnerabilities in Premium Packages WordPress plugin
See all- CVE-2026-118404Unknown
The Premium Packages WordPress plugin before 7.3.1 does not verify ownership or session binding when loading a previously saved shopping cart. This allows any unauthenticated user who obtains another shopper's saved-cart identifier to load that shopper's cart contents into their own session.
- CVE-2026-118403Unknown
The Premium Packages WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before returning its details. This allows unauthenticated visitors who know a guest order's identifier to view its order status, payment status and total.
Original NVD description (English source)
The Premium Packages WordPress plugin before 7.3.1 does not verify that a user claiming a guest order is the original buyer, allowing any authenticated user to take ownership of any unclaimed guest order, and thereby read the buyer's billing details and download their purchased files, by supplying only the order identifier.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS