{"id":"CVE-2026-118184","title":"Premium Packages < 7.2.2 - Unauthenticated Order Total Manipulation","summary":"The Premium Packages  WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the stored price of items in their shopping cart, allowing them to create orders for any product at an arbitrary total of thei…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvssSource":"adp","cwe":["CWE-862"],"product":"Premium Packages","affected":["premium_packages < 7.2.2"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-11-01T17:28:07.336628Z"},"published":"2026-10-31","updated":"2026-11-01","sourceUpdated":"2026-11-01T17:34:17.566Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-118184","references":[{"url":"https://wpscan.com/vulnerability/38c4d58a-20a3-4309-ace7-5b567257c80e/"}],"tags":["cve.org"],"epss":0.00214,"epssPercentile":0.11809,"ingestedAt":"2026-11-05T18:28:50.804Z","slug":"CVE-2026-118184","body":"## Overview\n\nThe Premium Packages  WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the stored price of items in their shopping cart, allowing them to create orders for any product at an arbitrary total of their choosing.\n\n## Affected\n\n- `premium_packages < 7.2.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}