# CVE-2026-118184: CVE-2026-118184

Status: published. Published: 2026-10-31. Updated: 2026-11-01.

The Premium Packages  WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the stored price of items in their shopping cart, allowing them to create orders for any product at an arbitrary total of their choosing.

## Remediation

No remediation reported in collected sources

## Affected products and versions

Not reported in collected sources.

## Severity and prioritization

- CVSS 3.1: 5.3 (medium); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N; source: NVD: 134c704f-9b21-4f2e-91b3-4a467353bcc0

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: exploitation none; automatable yes; technical impact partial; source NVD SSVC: 134c704f-9b21-4f2e-91b3-4a467353bcc0

- Weaknesses: CWE-862

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://wpscan.com/vulnerability/38c4d58a-20a3-4309-ace7-5b567257c80e/ (contact@wpscan.com)

## Provenance

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-118184; retrieved 2026-11-02; source updated 2026-11-01

Revision: 359e1f48e0f4e2ad9d51373f8d5aa9076486c3725a454993c23cb186f020d622

Canonical: https://y2.dev/cve/CVE-2026-118184