---
id: CVE-2026-118184
title: Premium Packages < 7.2.2 - Unauthenticated Order Total Manipulation
summary: >-
  The Premium Packages  WordPress plugin before 7.2.2 does not prevent
  unauthenticated visitors from overwriting the stored price of items in their
  shopping cart, allowing them to create orders for any product at an arbitrary
  total of thei…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: adp
cwe:
  - CWE-862
product: Premium Packages
affected:
  - premium_packages < 7.2.2
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-01T17:28:07.336628Z'
published: '2026-10-31'
updated: '2026-11-01'
sourceUpdated: '2026-11-01T17:34:17.566Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118184'
references:
  - url: 'https://wpscan.com/vulnerability/38c4d58a-20a3-4309-ace7-5b567257c80e/'
tags:
  - cve.org
epss: 0.00214
epssPercentile: 0.11809
ingestedAt: '2026-11-05T18:28:50.804Z'
---

## Overview

The Premium Packages  WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the stored price of items in their shopping cart, allowing them to create orders for any product at an arbitrary total of their choosing.

## Affected

- `premium_packages < 7.2.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.