PT-2026-134427

CVE-2026-118184

Published

2026-10-29

Updated

2026-10-31

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Premium Packages WordPress plugin versions prior to 7.2.2

Description Unauthenticated visitors can overwrite the stored price of items in their shopping cart, enabling the creation of orders for any product at an arbitrary total. This occurs due to a missing capability check in a function, which allows unauthorized users to perform restricted actions.

Recommendations Update the plugin to version 7.2.2 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Ryan Fabella

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization

Related identifiers