Bopo Bundle Builder EUVD-2026-109712

The affected software is the VillaTheme 'Bopo - WooCommerce Product Bundle Builder' WordPress plugin running on a WooCommerce/WordPress site, versions up to and including 1.2.3. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation is remote and requires no authentication and no user interaction. However, the available sources do not describe which exact plugin action, endpoint, or feature lacks the authorization check, so the precise trigger is not described in the available sources. The limiting factors are the plugin's relatively narrow deployment footprint and the restricted impact (integrity-only, no confidentiality or availability), which bound the realistic damage even though no special configuration appears to be required.

This is a moderate-severity Missing Authorization flaw (CWE-862) with a CVSS 3.1 score of 5.3 and vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, meaning network-reachable, low-complexity exploitation by remote attackers with no authentication (PR:N) and no user interaction. The impact is limited to a low integrity effect only (C:N, I:L, A:N) - no confidentiality loss and no availability impact - so the realistic consequence is unauthorized modification of some limited plugin data or action rather than full compromise. The vuln.today decision label is 'this_month', indicating prioritized but not emergency remediation. No EPSS score, no CISA KEV listing, and no verified exploit code are present in the input, so there is no signal of active or widespread exploitation; this reads as a genuine-but-contained access-control weakness rather than a high-urgency crisis. Note a terminology tension: the CWE is Missing Authorization / Broken Access Control, yet the input Tags include 'Authentication Bypass' - these are distinct concepts, and the vulnerability is access-control (authorization), not authentication bypass per the CWE and advisory.

A remote, unauthenticated attacker sends a crafted request directly to an access-control-protected action or endpoint exposed by the Bopo plugin on a WooCommerce site, which fails to verify the caller's authorization. Because the privilege check is missing, the attacker performs an operation that should require a logged-in or higher-privileged user, resulting in limited unauthorized data modification. No public, verified exploit code is identified in the provided sources; only a Patchstack advisory reference exists.