CVE-2026-118407: Premium Packages < 7.3.1 - Subscriber+ Guest Order Takeover
The Premium Packages WordPress plugin before 7.3.1 does not verify that a user claiming a guest order is the original buyer, allowing any authenticated user to take ownership of any unclaimed guest order, and thereby read the buyer's billing details and download their purchased files, by supplying only the order identifier.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with subscriber-level access or higher can exploit it. The attacker only needs the identifier of an unclaimed guest order.
What information or access could an attacker gain?
An attacker can take ownership of an unclaimed guest order, view the original buyer's billing details, and download files purchased through that order.
Are guest orders specifically required for exploitation?
Yes. The affected order must be an unclaimed guest order; the issue concerns the process used to claim ownership of those orders.