CVE-2026-118404 · Package
NO FIX YET · SEE WHAT TO DO
The Premium Packages WordPress plugin before 7.3.1 does not check who owns a saved shopping cart when it is loaded. Anyone who obtains another shopper's saved-cart identifier can load that cart, including products, quantities and custom field data the buyer entered, into their own session.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Stores running the Premium Packages WordPress plugin before 7.3.1 that offer saved carts. The exposure is through the saved-cart load path, so sites that do not use saved carts are likely not reachable this way. Sources do not say how default configurations behave.
Not affected if plugin-version-7.3.1-or-later, saved-carts-unused
Who cares ecommerce, self-hosted, woocommerce, wordpress
7.3.17.3.1 or laterThe Premium Packages WordPress plugin before 7.3.1 does not verify ownership or session binding when loading a previously saved shopping cart, allowing any unauthenticated user who obtains another shopper's saved-cart identifier to load that shopper's cart contents, including selected products, quantities and buyer-entered custom field data, into their own session.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.