CVE-2026-110377: WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.2.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in VillaTheme Bopo – WooCommerce Product Bundle Builder bopo-woo-product-bundle-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bopo – WooCommerce Product Bundle Builder: from n/a through 1.2.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
VillaTheme Bopo – WooCommerce Product Bundle Builderto a version that resolves this vulnerability.Fixed in 1.2.4
Event History
Frequently Asked Questions
Which versions are affected?
The issue affects Bopo – WooCommerce Product Bundle Builder versions through 1.2.3. The available data does not identify a fixed version.
Can this be exploited remotely without authentication?
Yes. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
What is the likely security impact?
The reported impact is limited to integrity: an attacker may be able to make unauthorized changes. No confidentiality or availability impact is indicated by the supplied CVSS vector.