PT-2026-136865

CVE-2026-118403

Published

2026-11-04

Updated

2026-11-04

Description by

CVSS 3.1

3.7

Low

MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Premium Packages versions prior to 7.3.1

Description An Insecure Direct Object Reference (IDOR) exists where the plugin fails to verify if the requester owns a guest order before returning its details. This allows unauthenticated visitors who possess a guest order identifier to view the order status, payment status, and total. The issue stems from missing validation on a user-controlled key.

Recommendations Update to version 7.3.1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Ryan Fabella

Vendors

Affected products

Weakness enumeration

CWE-639: Authorization Bypass Through User-Controlled Key

Related identifiers