Session Manipulation Vulnerability in Premium Packages Plugin for WordPress
CVE-2026-118404

Currently unrated

Key Information:

Vendor

WordPress
Status
Premium Packages
Vendor
CVE Published:
4 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-118404?

The Premium Packages WordPress plugin prior to version 7.3.1 contains a flaw that permits any unauthenticated user to gain access to another user's shopping cart by exploiting a lack of verification for ownership when loading saved carts. This oversight allows a malicious user to use the saved-cart identifier of another shopper to access sensitive information, including the contents of the cart, selected products, quantities, and any custom field data entered by the buyer. This breach poses significant risks by compromising user privacy and data integrity.

Affected Version(s)

Premium Packages 0 < 7.3.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-118404 - Proof of Concept

References

https://wpscan.com/vulnerability/008e4d20-83b0-48f6-a709-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ryan Fabella
WPScan
.