{"affected":[{"defaultStatus":"unaffected","product":"Premium Packages","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"7.3.1","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-118404","cwes":["CWE-200"],"description":"The Premium Packages  WordPress plugin before 7.3.1 does not verify ownership or session binding when loading a previously saved shopping cart, allowing any unauthenticated user who obtains another shopper's saved-cart identifier to load that shopper's cart contents, including selected products, quantities and buyer-entered custom field data, into their own session.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/008e4d20-83b0-48f6-a709-539036e1f678/"}],"kev":null,"metrics":[],"modifiedAt":1793772027909,"publishedAt":1793772027909,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/008e4d20-83b0-48f6-a709-539036e1f678/"}],"remediation":[],"revision":"963bb0d51e883921ac3ca55e0848433ba8473e7a8b0e08402dff34bff2c7b20a","sources":[{"modifiedAt":1793772027909,"name":"CNA: WPScan","retrievedAt":1793776143300,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118404"}],"ssvc":null,"status":"published","title":"Premium Packages < 7.3.1 - Unauthenticated Cross-User Saved Cart Disclosure via IDOR","updatedAt":1793776143300}