CVE-2026-18945

Name of the Vulnerable Software and Affected Versions WP Helper Premium versions prior to 4.7.6

Description Insufficient verification of the order key occurs when rendering the custom order confirmation page or handling related AJAX actions. This allows unauthenticated users to view personal information and order details of other customers, as well as modify the state of arbitrary orders. This issue requires WooCommerce to be active and the optional order confirmation page module of the plugin to be enabled.

Recommendations Update WP Helper Premium to version 4.7.6 or later. As a temporary mitigation, disable the optional order confirmation page module.