CVE-2026-118184 in Premium Packages Plugin
Summary
by MITRE • 10/31/2026
The Premium Packages WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the stored price of items in their shopping cart, allowing them to create orders for any product at an arbitrary total of their choosing.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/31/2026
The vulnerability identified within the Premium Packages WordPress plugin prior to version 7.2.2 represents a critical failure in server-side validation and data integrity controls during e-commerce transactions. This flaw specifically targets the shopping cart mechanism, allowing unauthenticated users to manipulate the price of items before finalizing an order. In standard web application security principles, client-supplied data such as product prices must never be trusted implicitly. Instead, these values should always be retrieved from a secure server-side database or configuration file at the moment of transaction processing. By failing to enforce this separation between user input and authoritative price data, the plugin exposes itself to severe financial exploitation where attackers can bypass legitimate pricing structures entirely.
From a technical perspective, the core issue lies in how the application handles state management for shopping cart items. When an unauthenticated visitor adds products to their cart or modifies quantities, the system likely accepts the price parameter directly from the HTTP request payload without re-verifying it against the canonical product definition stored on the server. This lack of validation allows a malicious actor to intercept network traffic using tools like Burp Suite or OWASP ZAP and modify the price field in the POST request associated with adding an item to the cart or updating the checkout process. Since the application does not cross-reference this submitted value with the actual database record for that specific product, it proceeds to calculate totals based on the tampered figures rather than the intended retail prices.
The operational impact of this vulnerability is predominantly financial but also extends to data integrity and system reliability. Attackers can exploit this flaw to purchase high-value goods or services at negligible costs, effectively stealing inventory through fraudulent transactions. This not only results in direct revenue loss for the business owner but also complicates order fulfillment logistics as legitimate orders are mixed with artificially low-priced ones that may be rejected by payment gateways due to suspicious activity patterns. Furthermore, because this affects unauthenticated users, the attack surface is maximized; any visitor to the website can attempt these manipulations without needing valid credentials or prior interaction history, making it a high-risk vulnerability for public-facing e-commerce sites running WordPress.
This flaw aligns closely with CWE-20 Improper Input Validation and CWE-841 Improper Enforcement of Transactional Integrity within the Common Weakness Enumeration framework. It also maps to specific tactics in the MITRE ATT&CK enterprise matrix, particularly those related to Resource Hijacking or Financial Theft via exploitation of business logic flaws rather than traditional code injection techniques. The absence of proper authorization checks for price modification further highlights a deficiency in access control mechanisms designed to protect sensitive transactional data from unauthorized alteration by external actors who should only have read-only access to product catalogs and pricing information.
To mitigate this vulnerability, immediate action is required to upgrade the Premium Packages plugin to version 7.2.2 or later where these validation checks are presumably corrected. In addition to updating software, developers must implement robust server-side price verification logic for all e-commerce operations. This involves ensuring that every time a product is added to a cart, updated in quantity, or moved to checkout, the application queries the database for the current authoritative price of each item and uses that value exclusively for calculation purposes. Client-supplied price data should be discarded entirely from transactional calculations. Implementing these controls ensures that even if an attacker modifies HTTP requests, the final order total will reflect the true market value defined by the system administrator, thereby preserving financial integrity and preventing unauthorized discounts or free acquisitions of goods.