{"id":"CVE-2026-118184","kind":"vulnerability","aliases":["CVE-2026-118184"],"related":[],"title":"Premium Packages WordPress plugin lets visitors set their own cart prices","description":"The Premium Packages  WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the stored price of items in their shopping cart, allowing them to create orders for any product at an arbitrary total of their choosing.","summary":"The Premium Packages WordPress plugin before 7.2.2 lets unauthenticated visitors overwrite the stored price of items in their shopping cart. An attacker can place orders for any product at an arbitrary total they choose.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","package","woocommerce","wordpress"],"not_affected_if":["no-cart-or-checkout","plugin-version-7.2.2-or-later"],"how_to_check":"- Check the installed version of the Premium Packages plugin in the WordPress admin plugins list; versions before `7.2.2` are affected.","fix":"- Premium Packages plugin: move to `7.2.2` or later.","status":"open","published_at":"2026-10-31T06:16:33+00:00","first_seen_at":"2026-10-31T06:33:50+00:00","triaged_at":"2026-10-31T06:34:27+00:00","updated_at":"2026-10-31T06:34:27+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-31T06:34:27Z","model":"claude-haiku-5-5","output":{"fix":"- Premium Packages plugin: move to `7.2.2` or later.","reach":"internet","title":"Premium Packages WordPress plugin lets visitors set their own cart prices","impact":"high","summary":"The Premium Packages WordPress plugin before 7.2.2 lets unauthenticated visitors overwrite the stored price of items in their shopping cart. An attacker can place orders for any product at an arbitrary total they choose.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","ecommerce"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Orders placed for any product at attacker-chosen totals","analyst_note":"Confirm the affected version range and any vendor advisory at the NVD entry; sources give only the 'before 7.2.2' bound.","how_to_check":"- Check the installed version of the Premium Packages plugin in the WordPress admin plugins list; versions before `7.2.2` are affected.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-version-7.2.2-or-later","no-cart-or-checkout"],"who_is_affected":"Sites running the Premium Packages WordPress plugin before 7.2.2 that take orders or payments through its cart. The description does not say whether specific plugin settings or payment configurations change exposure, so unknown beyond that.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000675,"input_tokens":4104,"output_tokens":529,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118184':14A,17A '-2026':13A,16A '7.2.2':28B,62C 'allow':79C 'arbitrari':52B,89C 'attack':43B 'cart':10A,41B,78C 'choos':55B,93C 'creat':82C 'cve':12A,15A 'ecommerc':18B 'item':37B,74C 'let':5A,29B 'order':46B,83C 'overwrit':32B,69C 'packag':2A,19B,24B,58C 'place':45B 'plugin':4A,26B,60C 'premium':1A,23B,57C 'prevent':65C 'price':11A,35B,72C 'product':49B,86C 'set':7A 'shop':40B,77C 'store':34B,71C 'total':53B,90C 'unauthent':30B,66C 'visitor':6A,31B,67C 'woocommerc':20B 'wordpress':3A,21B,25B,59C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Premium Packages WordPress plugin before 7.2.2 that take orders or payments through its cart. The description does not say whether specific plugin settings or payment configurations change exposure, so unknown beyond that.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T06:16:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118184","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118184","severity":null,"published_at":"2026-10-31T06:16:33+00:00","modified_at":"2026-10-31T06:16:33+00:00","first_seen_at":"2026-10-31T06:33:50+00:00","fetched_at":"2026-10-31T06:33:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}