CVE-2026-118403

Premium Packages < 7.3.1 - Unauthenticated Guest Order Status Disclosure

State: published CNA: WPScan CVSS 3.1 3.7 Low NVD: deferred

Description

The Premium Packages WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before returning its details, allowing unauthenticated visitors who know a guest order's identifier to view its order status, payment status and total.

Affected products

Vendor	Product	Versions
n/a	Premium Packages	<7.3.1

References

External links from the record. They lead to third-party sites.

https://wpscan.com/vulnerability/d316f5c9-51f3-43d7-9ffe-e47ab7187dcb/ exploit, technical-description, vdb-entry

Dates

Reserved: 2026-10-28
Published: 2026-11-04
Updated: 2026-11-04

CVSS

3.7 Low

Version: 3.1
Source: ADP (CISA-ADP)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.162% probability of exploitation activity in the next 30 days

Percentile: 5.421%
Score date: 2026-11-09
Model: v2026.06.15

Weakness

CWE-639 Authorization Bypass Through User-Controlled Key

NVD

Status: Deferred
Published: 2026-11-04
Modified: 2026-11-04

3.7 Low CVSS 3.1 · CISA-ADP, secondary
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

This CVE at nvd.nist.gov