---
id: CVE-2026-118407
title: Premium Packages < 7.3.1 - Subscriber+ Guest Order Takeover
summary: >-
  The Premium Packages  WordPress plugin before 7.3.1 does not verify that a
  user claiming a guest order is the original buyer, allowing any authenticated
  user to take ownership of any unclaimed guest order, and thereby read the
  buyer's bi…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cvssSource: adp
cwe:
  - CWE-639
product: Premium Packages
affected:
  - premium_packages < 7.3.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-04T14:01:47.074372Z'
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T14:18:19.610Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118407'
references:
  - url: 'https://wpscan.com/vulnerability/541a09e1-e11d-4a17-94cb-4d5e2664bdf1/'
tags:
  - cve.org
epss: 0.00138
epssPercentile: 0.03185
ingestedAt: '2026-11-05T21:36:00.361Z'
---

## Overview

The Premium Packages  WordPress plugin before 7.3.1 does not verify that a user claiming a guest order is the original buyer, allowing any authenticated user to take ownership of any unclaimed guest order, and thereby read the buyer's billing details and download their purchased files, by supplying only the order identifier.

## Affected

- `premium_packages < 7.3.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.