{"id":"CVE-2026-118404","title":"Premium Packages < 7.3.1 - Unauthenticated Cross-User Saved Cart Disclosure via IDOR","summary":"The Premium Packages  WordPress plugin before 7.3.1 does not verify ownership or session binding when loading a previously saved shopping cart, allowing any unauthenticated user who obtains another shopper's saved-cart identifier to load…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvssSource":"adp","cwe":["CWE-200"],"product":"Premium Packages","affected":["premium_packages < 7.3.1"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-11-04T14:02:03.201699Z"},"published":"2026-11-04","updated":"2026-11-04","sourceUpdated":"2026-11-04T14:18:19.760Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-118404","references":[{"url":"https://wpscan.com/vulnerability/008e4d20-83b0-48f6-a709-539036e1f678/"}],"tags":["cve.org"],"epss":0.00206,"epssPercentile":0.10727,"ingestedAt":"2026-11-05T21:36:00.362Z","slug":"CVE-2026-118404","body":"## Overview\n\nThe Premium Packages  WordPress plugin before 7.3.1 does not verify ownership or session binding when loading a previously saved shopping cart, allowing any unauthenticated user who obtains another shopper's saved-cart identifier to load that shopper's cart contents, including selected products, quantities and buyer-entered custom field data, into their own session.\n\n## Affected\n\n- `premium_packages < 7.3.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}