Wpc Product Bundles For Woocommerce EUVD-2026-11923

The CVSS v3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) indicates a network-accessible vulnerability with low attack complexity that requires low privileges (authenticated user) but results in only low confidentiality impact with no integrity or availability impact. This suggests the vulnerability allows information disclosure rather than system compromise. The CVSS base score of 4.3 places it in the 'medium' severity range for vulnerability databases, but real-world risk depends on deployment context: in multi-user WordPress environments with customer accounts, this is more serious; in single-admin installations, less so. The requirement for authentication (PR:L) significantly reduces opportunistic exploitation compared to unauthenticated flaws. Without confirmed EPSS score, KEV status, or public POC data in this analysis, the vulnerability should be prioritized based on the sensitivity of data exposed through the plugin and the number of low-privilege users in the WooCommerce installation. Organizations using WPC Product Bundles with multiple vendor or customer accounts should treat this as higher priority; those with restricted admin access may deprioritize pending patch availability.

An authenticated customer or shop vendor with low privileges (e.g., shop_manager or customer role) logs into a WordPress site running vulnerable WPC Product Bundles and directly accesses administrative endpoints that should be restricted to site administrators. Due to missing authorization checks, the attacker can view confidential product bundle pricing, discount codes, margin calculations, or inventory data not intended for their role. The attack requires no user interaction and succeeds over the network via HTTP requests; the attacker could automate this to enumerate multiple bundles or export sensitive pricing information for competitive analysis or fraud.