CVE-2026-18945 is a WooCommerce authorization bypass in the WP Helper Premium plugin (versions before 4.7.6) that allows unauthenticated attackers to read personal information from arbitrary orders and manipulate order states. The CVSS 8.2 score is technically defensible but overstates real-world risk for most deployments.
The critical factor determining your exposure is whether the order confirmation page module is enabled. In default installations, this optional module is likely disabled—meaning the actual exposed population is a fraction of total plugin installations. However, any admin enabling this module after installation creates immediate, non-logged exposure that may not register as a security-relevant configuration change. The optional module pattern means your attack surface isn't static; it pulses with feature enablement decisions.
Two components make this more dangerous than a typical IDOR. First, the order state manipulation vector doesn't require sophisticated enumeration—changing an order to 'refunded' triggers WooCommerce hooks that can cascade into inventory adjustments, payment gateway callbacks, CRM syncs, and fulfillment API pushes. An attacker with no interest in PII can still disrupt operations by flipping order states at scale. Second, WooCommerce's default order ID generation is sequential, making unauthenticated order enumeration practical at internet scale unless the plugin implements rate-limiting or order key verification.
The 4.7.6 patch added authorization checks, but your priority depends on configuration: if the module is disabled, patch on your normal cycle but recognize you'll carry latent risk if anyone enables it later. If enabled, treat this as urgent—prioritize the patch and audit your WooCommerce order logs for any unauthorized state changes around the disclosure date. Regardless of current state, audit whether other optional modules in WP Helper share the same assumption that WooCommerce context implies authorization; this vulnerability class tends to recur across a plugin's optional feature set.