[ CVE-2026-118184 · Published 31 Oct 2026 ]
Vulnerability in Unknown Premium Packages
CVSS 5.3
EPSS <1%No fix listed yet
[ Description ]Official description
The Premium Packages WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the stored price of items in their shopping cart, allowing them to create orders for any product at an arbitrary total of their choosing.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.