CVE-2026-18945: WP Helper Premium < 4.7.6 - Unauthenticated Order Data Disclosure and Order Manipulation via Missing Order Key Validation
The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change the state of arbitrary orders.
Exploitation requires WooCommerce to be active and the WP Helper Premium WordPress plugin before 4.7.6's optional order confirmation page module to be enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WP Helper Premium WordPress pluginto a version that resolves this vulnerability.Fixed in 4.7.6 - Configuration
Ensure the optional order confirmation page module is disabled unless needed, since exploitation depends on it being enabled.
WooCommerce order confirmation module (optional) order confirmation page module enabled = false
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18945?
CVE-2026-18945 has a risk score of 60, indicating a medium severity vulnerability.
How do I fix CVE-2026-18945?
To fix CVE-2026-18945, update the WP Helper Premium plugin to version 4.7.6 or higher.
What are the consequences of CVE-2026-18945?
CVE-2026-18945 allows unauthenticated users to access sensitive order details and manipulate orders.
Who is affected by CVE-2026-18945?
Any website using WP Helper Premium plugin versions prior to 4.7.6 is affected by CVE-2026-18945.
What does CVE-2026-18945 exploit?
CVE-2026-18945 exploits the lack of order key validation when rendering custom confirmation pages and handling AJAX actions.