CVE-2026-118184— Premium Packages < 7.2.2 - Unauthenticated Order Total Manipulation
Quick assessment
Affected
Unknown Premium Packages
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Premium Packages WordPress 插件在 7.2.2 版本之前存在安全漏洞，未能阻止未授权访问者覆盖其购物车中商品的存储价格，从而允许攻击者为任意商品创建订单，并自行设定任意总金额。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-118184
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Premium Packages < 7.2.2 - Unauthenticated Order Total Manipulation
Source: CVE Program / CVE List V5
Vulnerability Description
The Premium Packages WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the stored price of items in their shopping cart, allowing them to create orders for any product at an arbitrary total of their choosing.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Premium Packages | 0 ~ 7.2.2 | - |
|
II. Public POCs for CVE-2026-118184
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-118184
请登录查看更多情报信息。
Other References for CVE-2026-118184 (1)
-
https://wpscan.com/vulnerability/38c4d58a-20a3-4309-ace7-5b567257c80e/ exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-10-31 · 11 CVEs total
| CVE-2026-94361 | PAYable IPG < 1.3.1 - Unauthenticated Order Payment Forgery via Unsigned Callback | |
| CVE-2026-118185 | Security Optimizer < 1.6.9 - 2FA Bypass via Missing Rate Limiting | |
| CVE-2026-118629 | All-in-One Video Gallery < 5.0.0 - Unauthenticated Private and Draft Video Disclosure | |
| CVE-2026-118438 | Firelight Lightbox < 2.3.24 - Contributor+ Stored XSS via Image 'src' Attribute | |
| CVE-2026-118638 | Mapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Modification via save-mapmaker RE | |
| CVE-2026-118437 | BuddyForms 2.8.8 - 2.10.0 - Unauthenticated Guest Attachment Deletion | |
| CVE-2026-82214 | Quick Event Manager 8.4.6 - 9.18 - Unauthenticated Private and Draft Content Disclosure vi | |
| CVE-2026-118043 | Bulk Media Register < 2.01 - Author+ Arbitrary File Move via Path Traversal | |
| CVE-2026-110808 | Essential Addons for Elementor 6.6.0 - 6.8.7 - Author+ Privilege Escalation via register_u | |
| CVE-2026-110042 | Payment Forms for Paystack < 4.0.6 - Contributor+ Sensitive Information Disclosure via Set |
IV. Related Vulnerabilities
Same vendor: Unknown
-
CVE-2026-94361
PAYable IPG < 1.3.1 - Unauthenticated Order Payment Forgery -
CVE-2026-118185
Security Optimizer < 1.6.9 - 2FA Bypass via Missing Rate Lim -
CVE-2026-118629
All-in-One Video Gallery < 5.0.0 - Unauthenticated Private a -
CVE-2026-118438
Firelight Lightbox < 2.3.24 - Contributor+ Stored XSS via Im -
CVE-2026-118638
Mapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Mod