{"affected":[{"defaultStatus":"unaffected","product":"Premium Packages","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"7.3.1","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-118403","cwes":["CWE-639"],"description":"The Premium Packages  WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before returning its details, allowing unauthenticated visitors who know a guest order's identifier to view its order status, payment status and total.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/d316f5c9-51f3-43d7-9ffe-e47ab7187dcb/"}],"kev":null,"metrics":[],"modifiedAt":1793772027725,"publishedAt":1793772027725,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/d316f5c9-51f3-43d7-9ffe-e47ab7187dcb/"}],"remediation":[],"revision":"aec28f34980881cf353101acc9221c6930118c6b15e528a6f24e992d40e30766","sources":[{"modifiedAt":1793772027725,"name":"CNA: WPScan","retrievedAt":1793776142151,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118403"}],"ssvc":null,"status":"published","title":"Premium Packages < 7.3.1 - Unauthenticated Guest Order Status Disclosure","updatedAt":1793776142151}