Premium Packages CVE-2026-118184

Requires the Premium Packages WordPress plugin at a version before 7.2.2 to be installed and active with its shopping-cart/ordering functionality in use; the vulnerable path is that the plugin trusts a client-supplied or stored cart price that an unauthenticated visitor can overwrite before checkout. No authentication, no user interaction, and no non-default configuration are stated as prerequisites (PR:N/UI:N), so default installations handling purchases are exposed. The practical limiting factors are that the site must actually use the plugin for paid orders and that impact is confined to order/pricing integrity (fraudulent totals) rather than data disclosure or service disruption; the exact request/parameter used to overwrite the price is not described in the available sources.

Signals are consistent and point to a genuine but non-emergency issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3 Medium) describes a remotely reachable, low-complexity flaw needing no authentication or user interaction, but with only limited integrity impact and no confidentiality or availability loss. EPSS is very low (0.14%, 4th percentile) and SSVC records Exploitation: none, so there is no indication of active or imminent exploitation; it is not in CISA KEV. However, SSVC marks it Automatable: yes with partial technical impact, and the vuln.today decision label is 'this_month', indicating it should be remediated on a routine priority cycle rather than deferred. One caveat: the raw CVSS score likely understates real-world business impact - the flaw permits unauthenticated price tampering enabling fraudulent orders (direct financial loss to the merchant), which the I:L/C:N/A:N scoring does not fully capture. This is a legitimate medium-priority fix driven by financial-fraud risk rather than a widespread exploitation threat; the low EPSS and SSVC Exploitation: none suggest it is not currently being mass-exploited.

An unauthenticated visitor adds a product to the shopping cart of a site running Premium Packages before 7.2.2, then manipulates the stored cart price (e.g., via the checkout request) to set an arbitrary total, and completes an order for the full-priced goods at a price of their choosing. No authentication or user interaction is required (AV:N/PR:N/UI:N). No public exploit identified at time of analysis.