YITH Product Bundles CVE-2026-105878

Exploitation requires only network access to a WordPress site running YITH WooCommerce Product Bundles version 2.29.0 or earlier with the plugin active; per the CVSS vector (PR:N, UI:N) no authentication or user interaction is needed against default configurations. The practical limiting factor is scope: impact is confined to a low-integrity effect (I:L) on a specific bundle-related action or data element - there is no confidentiality exposure or availability/denial impact - and the store must actually have the vulnerable plugin installed and enabled. The advisory does not name a specific feature toggle or non-default setting as a precondition, indicating the missing authorization check is present in the standard plugin behavior.

This is a moderate-severity Missing Authorization (CWE-862) flaw in the YITH WooCommerce Product Bundles WordPress plugin, scored CVSS 5.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The vector signals a network-reachable, low-complexity, unauthenticated (PR:N) weakness requiring no user interaction, but with impact limited to integrity only (I:L) - no confidentiality (C:N) or availability (A:N) consequences. This pattern is typical of broken access control where an unauthenticated actor can invoke an action or modify a specific data element that should be gated behind an authorization check, rather than achieving full data disclosure or site takeover. No EPSS score was supplied in the input, the CVE is NOT on CISA KEV, and no public proof-of-concept is referenced (only the Patchstack advisory), so exploitation status is 'no public exploit identified at time of analysis.' Net assessment: the unauthenticated network vector keeps this worth patching on WooCommerce stores running the plugin, but the integrity-only, low-impact scope means it is a routine-priority broken-access-control issue, not a critical emergency - it is a real but bounded risk, well below high-CVSS/high-urgency flaws that also compromise confidentiality or allow code execution. EPSS data is missing from the input and cannot be weighed; this should be noted when triaging.

An unauthenticated attacker sends a crafted HTTP request directly to a vulnerable plugin endpoint or AJAX/REST action that fails to verify the caller's authorization, allowing them to perform or alter a bundle-related operation they should not be permitted to. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this requires only network access to the WooCommerce site and no credentials or user interaction. No public exploit code is referenced, so exploitation would require an attacker to independently identify the specific unprotected action.