Live › vulnerability › CVE-2026-118184
The Premium Packages WordPress plugin before 7.2.2 lets unauthenticated visitors overwrite the stored price of items in their shopping cart. An attacker can place orders for any product at an arbitrary total they choose.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 06:33 UTC. All times on this page are UTC.
Sites running the Premium Packages WordPress plugin before 7.2.2 that take orders or payments through its cart. The description does not say whether specific plugin settings or payment configurations change exposure, so unknown beyond that.
No product ranges from the sources yet.
7.2.2 are affected.7.2.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Premium Packages WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the stored price of items in their shopping cart, allowing them to create orders for any product at an arbitrary total of their choosing.
This page as .md · .json · in your agent: get_signal("CVE-2026-118184")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.