CVE-2026-118403 in Premium Packages Plugin
Summary
by MITRE • 11/04/2026
The Premium Packages WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before returning its details, allowing unauthenticated visitors who know a guest order's identifier to view its order status, payment status and total.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in the Premium Packages WordPress plugin prior to version 7.3.1 represents a critical failure in access control mechanisms, specifically categorized under CWE-284 Improper Access Control. This flaw stems from an insufficient verification process within the application logic that handles requests for guest order information. In secure web applications, any endpoint returning sensitive data must validate not only the authenticity of the request but also the authorization of the requester to view specific resources. The plugin fails to implement this essential check, allowing unauthenticated users who possess a valid guest order identifier to retrieve detailed transactional data without providing credentials or proof of ownership.
From a technical perspective, the vulnerability exploits an insecure direct object reference pattern where the application relies solely on the predictability or availability of the unique identifier for a guest order rather than binding that resource to a specific authenticated user session or verifying prior interaction with the system. When a request is made using this identifier, the backend processes it and returns the associated data without confirming whether the requester initiated the transaction or has any legitimate relationship to the order. This lack of server-side validation allows attackers to iterate through potential identifiers if they are sequential or guessable, facilitating unauthorized access to private information.
The operational impact of this vulnerability is significant for both end-users and site administrators. End users face a direct compromise of their privacy as sensitive financial details become exposed. Specifically, the ability to view order status, payment status, and total amounts means that an attacker can determine whether a transaction was successful, pending, or failed, along with the exact monetary value involved. This information leakage can be leveraged for further malicious activities such as targeted phishing attacks where attackers use real purchase details to appear legitimate, or social engineering campaigns aimed at exploiting customers based on their spending habits and financial status.
Furthermore, this exposure violates fundamental principles of data protection regulations such as GDPR in Europe or CCPA in California, which mandate strict controls over personal identifiable information and financial data. For the website owner, this vulnerability undermines trust and exposes them to potential legal liabilities due to negligence in protecting customer data. The ease with which an unauthenticated visitor can access these details highlights a severe gap in the plugin's security architecture, requiring immediate attention to prevent exploitation at scale.
To mitigate this risk, it is imperative that users of the Premium Packages WordPress plugin upgrade immediately to version 7.3.1 or later where this issue has been addressed by implementing proper authorization checks. For sites unable to update instantly due to compatibility constraints, temporary mitigations should include restricting access to any endpoints related to order details via web application firewall rules if such functionality is exposed through public-facing URLs that do not require authentication. Additionally, developers must ensure that all API endpoints and database queries enforce strict ownership verification by linking resource retrieval to authenticated user sessions or verifying session tokens against the specific transaction record before returning data. Regular security audits and penetration testing should be conducted to identify similar access control flaws in other plugins used on the WordPress installation.