---
id: "CVE-2026-118184"
kind: "vulnerability"
aliases: ["CVE-2026-118184"]
title: "Premium Packages WordPress plugin lets visitors set their own cart prices"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ecommerce", "package", "woocommerce", "wordpress"]
not_affected_if: ["no-cart-or-checkout", "plugin-version-7.2.2-or-later"]
published_at: "2026-10-31T06:16:33+00:00"
first_seen_at: "2026-10-31T06:33:50+00:00"
updated_at: "2026-10-31T06:34:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118184", "first_seen_at": "2026-10-31T06:33:50+00:00"}]
---

# Premium Packages WordPress plugin lets visitors set their own cart prices

The Premium Packages WordPress plugin before 7.2.2 lets unauthenticated visitors overwrite the stored price of items in their shopping cart. An attacker can place orders for any product at an arbitrary total they choose.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Premium Packages plugin in the WordPress admin plugins list; versions before `7.2.2` are affected.

## Fix

- Premium Packages plugin: move to `7.2.2` or later.

## Timeline

- 2026-10-31T06:33:50+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118184

## From the sources

The Premium Packages  WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the stored price of items in their shopping cart, allowing them to create orders for any product at an arbitrary total of their choosing.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_