CVE-2026-118184mediumCWE-862

CVE-2026-118184: medium-severity vulnerability in Premium Packages

Premium Packages < 7.2.2 - Unauthenticated Order Total Manipulation

Published · Updated

Follow this CVE+ Monitor Premium Packages

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.3epss 0.2%
The Premium Packages WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the stored price of items in their shopping cart, allowing them to create orders for any product at an arbitrary total of their choosing.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
Unknown · Premium Packages
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Premium Packages

In the same product, most dangerous first.

CVE-2026-93511MEDIUMPremium Packages < 7.2.1 - Unauthenticated PayPal Webhook Signature Verification BypassEPSS 0.3%CVE-2026-19711MEDIUMPremium Packages – Sell Digital Products Securely < 7.0.7 - Subscriber+ Arbitrary Amount Withdrawal RequestEPSS 0.3%