Unrated severityNVD Advisory· Published Nov 4, 2026

CVE-2026-118404

Description

The Premium Packages WordPress plugin before 7.3.1 does not verify ownership or session binding when loading a previously saved shopping cart, allowing any unauthenticated user who obtains another shopper's saved-cart identifier to load that shopper's cart contents, including selected products, quantities and buyer-entered custom field data, into their own session.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Wpdm Premium Packagesllm-fuzzy
Range: <7.3.1
Package: https://wordpress.org/plugins/wpdm-premium-packages

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/008e4d20-83b0-48f6-a709-539036e1f678/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000