---
id: "CVE-2026-118403"
kind: "vulnerability"
aliases: ["CVE-2026-118403"]
title: "Premium Packages WordPress plugin: guest order details exposed to unauthenticated visitors"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "premium-packages", "self-hosted", "woocommerce", "wordpress"]
not_affected_if: ["auth-required", "no-guest-orders", "plugin-7.3.1-or-later"]
published_at: "2026-11-04T06:17:02+00:00"
first_seen_at: "2026-11-04T06:25:19+00:00"
updated_at: "2026-11-04T06:26:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118403", "first_seen_at": "2026-11-04T06:25:19+00:00"}]
---

# Premium Packages WordPress plugin: guest order details exposed to unauthenticated visitors

The Premium Packages WordPress plugin before 7.3.1 returns guest order details without checking that the requester owns the order. An unauthenticated visitor who knows or guesses a guest order identifier can read its status, payment status and total.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Premium Packages plugin in the WordPress admin under Plugins; versions below `7.3.1` are affected.
- Confirm whether your store accepts guest orders, since the flaw only concerns guest order identifiers.

## Fix

- Premium Packages plugin: upgrade to `7.3.1` or later.

## Timeline

- 2026-11-04T06:25:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118403

## From the sources

The Premium Packages  WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before returning its details, allowing unauthenticated visitors who know a guest order's identifier to view its order status, payment status and total.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_