Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Premium Packages 7.3.1 Clear all filters
TI-2026-84967 CVE-2026-118407 · GHSA-mmxp-wx6x-2jp9

Premium Packages Subscriber+ Guest Order Takeover

Priority LOW 23

The Premium Packages WordPress plugin before 7.3.1 does not verify that a user claiming a guest order is the original buyer, allowing any authenticated user to take ownership of any unclaimed guest order, and thereby rea…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00138 Published 2026-11-04 Fixed in 7.3.1 CWE-639
TI-2026-84966 CVE-2026-118404 · GHSA-5x4q-vfvg-wp36

Saved cart disclosure in Premium Packages WordPress plugin

Priority LOW 29

The Premium Packages WordPress plugin before 7.3.1 does not verify ownership or session binding when loading a previously saved shopping cart, allowing any unauthenticated user who obtains another shopper's saved-cart id…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00206 Published 2026-11-04 Fixed in 7.3.1 CWE-200
TI-2026-84965 CVE-2026-118403 · GHSA-43m8-2m67-x874

Authorization bypass in Premium Packages exposes guest order details

Priority LOW 17

The Premium Packages WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before returning its details, allowing unauthenticated visitors who know a guest order's identifier to view its ord…

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00162 Published 2026-11-04 Fixed in 7.3.1 CWE-639