YITH Product Bundles CVE-2026-111845

Requires the YITH WooCommerce Product Bundles plugin to be installed and active at version 2.29.0 or earlier on a WordPress/WooCommerce site. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special configuration are needed - exploitation is remote against a default installation. The primary LIMITING factor is impact scope: only a LOW integrity effect is possible (C:N/A:N), meaning the attacker can perform or alter a restricted plugin action but cannot read confidential data or disrupt availability through this flaw. The description does not name the exact vulnerable feature/endpoint, which is the one detail defenders should confirm from the Patchstack advisory.

This is a moderate-severity Missing Authorization flaw (CWE-862) with a CVSS 3.1 base score of 5.3. The vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) indicates a remote, low-complexity, unauthenticated attack requiring no user interaction, but with impact restricted to a LOW integrity effect only - no confidentiality or availability loss. The low-and-integrity-only impact is the key moderating factor: an attacker can likely invoke a protected plugin action or modify limited data they should not be able to, but cannot read sensitive data or take the site down through this issue alone. No EPSS score, CISA KEV listing, or public proof-of-concept is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: this is a real but not high-priority issue - patch in normal cycles rather than emergency. The CVSS network/unauthenticated profile makes it broadly reachable, but the thin integrity-only impact keeps real-world risk modest. Note the vendor description is generic ('Exploiting Incorrectly Configured Access Control Security Levels') and does not name the exact protected endpoint, so the precise action an attacker can perform should be verified against the Patchstack advisory.

An unauthenticated attacker sends a crafted HTTP request directly to an AJAX or REST endpoint exposed by the YITH WooCommerce Product Bundles plugin (version ≤ 2.29.0) that fails to perform a capability/authorization check. Because no authentication or user interaction is required (PR:N/UI:N), the attacker triggers a privileged plugin action and modifies limited bundle-related data, consistent with the LOW integrity impact. No public exploit code is identified at time of analysis, so this would require the attacker to craft the request from the advisory details.