WordPress Plugin Vulnerabilities

Premium Packages < 7.3.1 - Subscriber+ Guest Order Takeover

Description

The plugin does not verify that a user claiming a guest order is the original buyer, allowing any authenticated user to take ownership of any unclaimed guest order, and thereby read the buyer's billing details and download their purchased files, by supplying only the order identifier.

Proof of Concept

Affects Plugins

Plugin icon
wpdm-premium-packages
Fixed in 7.3.1

References

CVE
CVE-2026-118407

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.4 (medium)

Miscellaneous

Verified
Yes
WPVDB ID
541a09e1-e11d-4a17-94cb-4d5e2664bdf1

Timeline

Publicly Published
2026-11-02 (about 2 days ago)
Added
2026-11-02 (about 1 day ago)
Last Updated
2026-11-02 (about 1 day ago)

Other

Published
Title
Published
2026-06-02
Title
Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Download
Published
2025-02-03
Title
Medical Addon for Elementor < 1.6.3 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode
Published
2026-03-11
Title
WpStream < 4.11.2 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2023-07-07
Title
Getnet Argentina para Woocommerce < 0.0.5 - Unauthenticated Authorization Bypass
Published
2026-07-29
Title
PeproDev WooCommerce Receipt Uploader < 2.15.0 - Unauthenticated Image Attachment Disclosure via IDOR