CVE-2026-118403 · Package
NO FIX YET · SEE WHAT TO DO
The Premium Packages WordPress plugin before 7.3.1 returns guest order details without checking that the requester owns the order. An unauthenticated visitor who knows or guesses a guest order identifier can read its status, payment status and total.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Sites running the Premium Packages WordPress plugin older than 7.3.1 that accept guest orders. The exposure is read-only order data (status, payment status, total) and is reachable by anyone who knows an order identifier, so sites with only logged-in customers or no guest checkout are likely not affected. Sources do not say how order identifiers are generated.
Not affected if auth-required, no-guest-orders, plugin-7.3.1-or-later
Who cares premium-packages, self-hosted, woocommerce, wordpress
7.3.1 are affected.7.3.1 or later.The Premium Packages WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before returning its details, allowing unauthenticated visitors who know a guest order's identifier to view its order status, payment status and total.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.