https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-06T00:08:09.183672+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-118404 CVE-2026-118404 — Premium Packages < 7.3.1 - Unauthenticated Cross-User Saved Cart Disclosure via IDOR 2026-11-06T00:08:09.184954+00:00

Affected: Unknown Premium Packages

The Premium Packages WordPress plugin before 7.3.1 does not verify ownership or session binding when loading a previously saved shopping cart, allowing any unauthenticated user who obtains another shopper's saved-cart identifier to load that shopper's cart contents, including selected products, quantities and buyer-entered custom field data, into their own session.