UNKNOWN NVD

CVE-2026-118403

The Premium Packages WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before returning its details, allowing unauthenticated

The Premium Packages WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before returning its details, allowing unauthenticated visitors who know a guest order's identifier to view its order status, payment status and total.

References

https://wpscan.com/vulnerability/d316f5c9-51f3-43d7-9ffe-e47ab7187dcb/

Published: 2026-11-04 · Source: NVD · Feed updated: 2026-11-04

This unknown severity vulnerability was published on 2026-11-04 via NVD.

vulnfeed aggregates 18348 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.