EUVD-2026-39669
GHSA-xfmv-28cq-q6w3
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
PR:L retained over PR:N due to conflict between title and official vector; AV:N and C:L are consistent with a network-accessible data disclosure with limited scope.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Sensitive Data Exposure in Bopo - WooCommerce Product Bundle Builder <= 1.1.6 versions.
AnalysisAI
Sensitive data exposure in the Bopo - WooCommerce Product Bundle Builder plugin for WordPress (versions ≤ 1.1.6) allows low-privileged authenticated users to access information that should be restricted to higher-trust roles. The flaw is classified under CWE-497, indicating the plugin exposes sensitive system or application data to an unauthorized control sphere - likely via an improperly protected REST API endpoint or AJAX action lacking appropriate capability checks. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere) typically manifests in WordPress plugins through REST API routes or admin-ajax handlers that register callbacks without enforcing proper WordPress capability checks (e.g., 'manage_woocommerce' or 'edit_posts'). The affected software is a WooCommerce extension - 'Bopo - WooCommerce Product Bundle Builder' - that enables merchants to create grouped product bundles in WooCommerce-powered stores. WooCommerce itself runs on WordPress and inherits its user role model (subscriber, contributor, editor, shop manager, administrator). The vulnerability exists in all versions up to and including 1.1.6. No CPE string was provided in the source data; the affected product is identified via Patchstack's plugin vulnerability database entry.
RemediationAI
Check the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/bopo-woo-product-bundle-builder/vulnerability/wordpress-bopo-woocommerce-product-bundle-builder-plugin-1-1-6-sensitive-data-exposure-vulnerability for an updated plugin version beyond 1.1.6; no exact fixed release version was confirmed in the available source data, so the patch status is 'Patch available per vendor advisory' - verify the current version in the WordPress plugin directory before upgrading. If an updated version is not yet available or cannot be deployed immediately, consider deactivating the plugin on sites with open user registration or untrusted authenticated user bases, accepting the trade-off of losing bundle-building functionality. Restrict user registration to trusted parties as a compensating control to raise the effective bar for exploitation from PR:L. Monitor the Patchstack entry for patch version confirmation.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today