CVE-2026-118404: Premium Packages < 7.3.1 - Unauthenticated Cross-User Saved Cart Disclosure via IDOR
The Premium Packages WordPress plugin before 7.3.1 does not verify ownership or session binding when loading a previously saved shopping cart, allowing any unauthenticated user who obtains another shopper's saved-cart identifier to load that shopper's cart contents, including selected products, quantities and buyer-entered custom field data, into their own session.
Event History
Frequently Asked Questions
What must an attacker have to access another shopper's saved cart?
The attacker needs a valid saved-cart identifier belonging to another shopper. No authentication is required, and the plugin does not bind the saved cart to its owner or original session.
What information can be exposed through a saved cart?
An attacker can load the other shopper's selected products, quantities, and buyer-entered custom field data into their own session. The specific sensitivity of the exposed data depends on what custom fields the store collects.
Are visitors who are not logged in affected?
Yes. The issue can be exploited by an unauthenticated user, provided they obtain another shopper's saved-cart identifier.