CVE-2026-118403 PUBLISHED

Premium Packages < 7.3.1 - Unauthenticated Guest Order Status Disclosure

Assigner: WPScan
Reserved: 28.10.2026 Published: 04.11.2026 Updated: 04.11.2026

The Premium Packages WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before returning its details, allowing unauthenticated visitors who know a guest order's identifier to view its order status, payment status and total.

Product Status

Vendor Unknown
Product Premium Packages
Versions Default: unaffected
  • affected from 0 to 7.3.1 (excl.)

Credits

  • Ryan Fabella finder
  • WPScan coordinator

References

Problem Types

  • CWE-639 Authorization Bypass Through User-Controlled Key CWE