CVE-2026-110377
MediumCVSS 5.3Summary
The Bopo – WooCommerce Product Bundle Builder plugin (up to version 1.2.3) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This may enable unauthenticated users to access restricted functionality.
Risk Assessment
An attacker could exploit this vulnerability to gain unauthorized access to product bundle builder features, potentially leading to data modification or information disclosure. The risk affects websites running the vulnerable plugin version.
Recommendation
Update the Bopo – WooCommerce Product Bundle Builder plugin to the latest version (above 1.2.3). If updating is not possible, consider disabling the plugin.
Other vulnerabilities in Bopo – WooCommerce Product Bundle Builder
See all- CVE-2026-57422High
The Bopo – WooCommerce Product Bundle Builder plugin for WordPress contains a reflected XSS (Cross-site Scripting) vulnerability due to improper input neutralization during page generation. The issue affects versions up to and including 1.2.0.
- CVE-2026-57664Medium
The vulnerability in the Bopo – WooCommerce Product Bundle Builder plugin version 1.1.6 and earlier allows unauthenticated attackers to access sensitive data. The flaw is due to insufficient protection of API endpoints or data exposure mechanisms.
Original NVD description (English source)
Missing Authorization vulnerability in VillaTheme Bopo – WooCommerce Product Bundle Builder bopo-woo-product-bundle-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bopo – WooCommerce Product Bundle Builder: from n/a through 1.2.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS