Public vulnerability disclosure

CVE-2026-118184

publishedCWE-862

The Premium Packages WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the stored price of items in their shopping cart, allowing them to create orders for any product at an arbitrary total of their choosing.

Investigate in Cyber JSON Markdown

Technical severity5.3 mediumCVSS 3.1 · NVD: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Published2026-10-31Source updated 2026-11-01

Collected2026-11-021 attributed source

Fixes and workarounds

No remediation reported in collected sources.

Missing remediation information is not evidence that no patch exists.

Affected products and versions

No affected-product ranges reported in collected sources.

CVSS assessments

CVSS scores, vectors and reporting authorities
Version / score	Vector	Authority
3.1 / 5.3 medium	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N`	NVD: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

References

https://wpscan.com/vulnerability/38c4d58a-20a3-4309-ace7-5b567257c80e/[email protected]