CVE-2026-18945
Received Received - Intake

Information Disclosure in WP Helper Premium WordPress Plugin

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: WPScan

Description
The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change the state of arbitrary orders. Exploitation requires WooCommerce to be active and the WP Helper Premium WordPress plugin before 4.7.6's optional order confirmation page module to be enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-18945
EUVD
EUVD-2026-57728

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpscan wp_helper_premium to 4.7.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in the WP Helper Premium WordPress plugin before version 4.7.6. It allows unauthenticated users to view other customers' order details, including personal information, and change the state of arbitrary orders due to missing validation of the order key.

Detection Guidance

Check if the WP Helper Premium plugin is installed and its version. If it is below 4.7.6, the system is vulnerable. Verify if WooCommerce is active and if the plugin's order confirmation page module is enabled.

Impact Analysis

Unauthenticated attackers could access sensitive customer data like names, addresses, and payment details. They could also modify order statuses, leading to financial or operational disruptions if WooCommerce is active and the plugin's order confirmation page module is enabled.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and HIPAA if protected health information was exposed. It results in non-compliance with data protection requirements for handling sensitive customer information.

Mitigation Strategies

Update the WP Helper Premium plugin to version 4.7.6 or later immediately. If updating is not possible, disable the plugin's order confirmation page module and ensure WooCommerce is not active if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18945. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart