Premium Packages WordPress plugin vulnerabilities

The Premium Packages WordPress plugin before 7.3.1 does not verify that a user claiming a guest order is the original buyer. This allows any authenticated user to take ownership of any unclaimed guest order by supplying only the order identifier.

The Premium Packages WordPress plugin before 7.3.1 does not verify ownership or session binding when loading a previously saved shopping cart. This allows any unauthenticated user who obtains another shopper's saved-cart identifier to load that shopper's cart contents into their own session.

The Premium Packages WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before returning its details. This allows unauthenticated visitors who know a guest order's identifier to view its order status, payment status and total.