PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-118184 WP Darko CVE debrief

The Premium Packages WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the stored price of items in their shopping cart, allowing them to create orders for any product at an arbitrary total of their choosing. This vulnerability impacts order processing and fulfillment, potentially allowing unauthorized modification of order totals. Defenders responsible for WordPress installations and plugins, particularly those using the Premium Packages plugin, should assess exposure and prioritize verification and remediation.

Vendor
WP Darko
Product
Premium Packages
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-31
Original CVE updated
2026-11-01
Advisory published
2026-10-31
Advisory updated
2026-11-01

Who should care

Defenders responsible for WordPress installations and plugins, particularly those using the Premium Packages plugin, should assess exposure and prioritize verification and remediation.

Why it matters

The Premium Packages WordPress plugin vulnerability allows unauthenticated visitors to modify order totals, potentially impacting order processing and fulfillment. Defenders should prioritize verification and remediation.

  • Potential for unauthorized modification of order totals
  • Possible impact on order processing and fulfillment
  • Need for verification of plugin version and remediation
  • Potential for abuse of this vulnerability

Technical summary

The Premium Packages WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the stored price of items in their shopping cart, allowing them to create orders for any product at an arbitrary total of their choosing. This vulnerability impacts order processing and fulfillment, and defenders should prioritize verifying and updating the Premium Packages WordPress plugin to version 7.2.2 or later.

Defensive priority

Defenders should prioritize verifying and updating the Premium Packages WordPress plugin to version 7.2.2 or later, and monitor for potential abuse of this vulnerability.

Recommended defensive actions

  • Verify and update the Premium Packages WordPress plugin to version 7.2.2 or later
  • Monitor for potential abuse of this vulnerability
  • Review and update inventory of WordPress installations and plugins

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on affected versions and remediation is limited. The vulnerability allows unauthenticated visitors to modify order totals, potentially impacting order processing and fulfillment. Defenders should verify plugin version and review inventory of WordPress installations and plugins. The source details are limited, so defenders should exercise caution and verify information through additional means.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-118184 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-118184

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-118184 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-118184

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.