CVE-2026-118404 in Premium Packages Plugin
Summary
by MITRE • 11/04/2026
The Premium Packages WordPress plugin before 7.3.1 does not verify ownership or session binding when loading a previously saved shopping cart, allowing any unauthenticated user who obtains another shopper's saved-cart identifier to load that shopper's cart contents, including selected products, quantities and buyer-entered custom field data, into their own session.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in the Premium Packages WordPress plugin prior to version 7.3.1 represents a critical failure in access control mechanisms, specifically concerning how shopping carts are managed during e-commerce transactions. This flaw stems from an insufficient verification of ownership and lack of proper session binding when retrieving previously saved cart data. In secure web application design, any resource that contains sensitive user-specific information must be strictly bound to the authenticated or identified session requesting it. However, in this implementation, the server-side logic relies solely on a client-supplied identifier for the saved cart without validating whether the current requestor is the legitimate owner of that cart data. This architectural oversight allows an unauthenticated attacker who obtains another shopper's saved-cart identifier to bypass any implicit security assumptions and directly access the contents associated with that identifier.
From a technical perspective, this vulnerability classifies as Broken Access Control, which corresponds to CWE-269 in the Common Weakness Enumeration standard. The core issue lies in the server's failure to enforce proper authorization checks before processing requests for saved cart data. When a user saves their shopping cart, the system generates or assigns an identifier that is stored on the server side along with the associated product details, quantities, and any custom field data entered by the buyer. Normally, this retrieval process should be tied to the active session ID of the logged-in user or require additional authentication tokens. Instead, the plugin accepts the saved-cart identifier as a standalone parameter and loads the corresponding cart into the requester's current context without verifying identity. This lack of server-side validation means that if an attacker can intercept or guess this identifier through methods such as cross-site scripting attacks, URL manipulation, or session hijacking, they gain unauthorized access to another user's private data.
The operational impact of this vulnerability is significant for both end-users and e-commerce operators. For the affected shoppers, the primary risk involves privacy violations and potential financial fraud. Since the saved cart includes buyer-entered custom field data, attackers can potentially extract personally identifiable information such as names, addresses, phone numbers, or other sensitive inputs provided during previous checkout attempts. Furthermore, loading another user's cart into their own session allows an attacker to view product selections that may indicate purchasing intent or preferences. In more severe scenarios, if the application proceeds automatically from a loaded saved cart to checkout without additional verification steps, an attacker could potentially complete a purchase using the victim’s stored payment methods or shipping details, leading to direct financial loss and reputational damage for both the customer and the merchant.
This behavior also aligns with techniques observed in the MITRE ATT&CK framework under the category of Collection via Client Side Scripts if exploited through cross-site scripting vectors, or generally as Unauthorized Access to Functionality when accessed directly via API manipulation. The vulnerability highlights a common pitfall in web development where developers assume that unique identifiers are sufficient for security without implementing robust session management protocols. To mitigate this risk, immediate action is required by updating the Premium Packages plugin to version 7.3.1 or later, where these access control checks have presumably been corrected. In environments where an update cannot be applied immediately, administrators should implement web application firewall rules that monitor and restrict requests containing saved-cart identifiers unless accompanied by valid session cookies from authenticated users. Additionally, enforcing strict input validation and ensuring that all sensitive operations require explicit authentication tokens can help prevent exploitation of similar flaws in other parts of the application infrastructure.