CVE-2026-118407
Medium
Description
The Premium Packages WordPress plugin before 7.3.1 does not verify that a user claiming a guest order is the original buyer, allowing any authenticated user to take ownership of any unclaimed guest order, and thereby read the buyer's billing details and download their purchased files, by supplying only the order identifier.
SeverityMedium
CVSS5.4
Exploit probability—
Product
Premium Packages
PublishedNov 4, 2026
First seenNov 4, 2026
How to fix
Update
- WordPress Premium Packages7.3.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| WordPress Premium Packages | No range specified | 7.3.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.