CVE-2026-118403 — Vulnerability intelligence

—

Published: 2026-11-04T06:17:02.693

CVSS

3.7

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

The Premium Packages WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before returning its details, allowing unauthenticated visitors who know a guest order's identifier to view its order status, payment status and total.

Sources

• CVE-2026-118403
• Original advisory