WPC Product Bundles EUVD-2026-36858

Target site must have WordPress with WooCommerce and the WPC Product Bundles for WooCommerce plugin installed and active at version 8.5.3 or earlier, with the vulnerable handler reachable over HTTP/S (the standard WordPress AJAX/REST surface). No authentication, no user interaction, and no non-default configuration are required (AV:N/AC:L/PR:N/UI:N). Exploitation is LIMITED to integrity impact only - the bug does not, per the CVSS vector, yield data disclosure or denial of service - and is bounded to whatever state the vulnerable handler is permitted to mutate within the plugin's scope.

Signals are mixed but lean toward moderate priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:N/I:H/A:N) indicates an easily reachable, unauthenticated network attack with high integrity impact only - consistent with data tampering rather than full compromise or data theft. There is no KEV listing and no public POC referenced, so this is not confirmed actively exploited; EPSS data was not provided in the input, so true exploitation likelihood cannot be quantified. WordPress plugin authorization gaps are historically a popular target for opportunistic scanners, so the realistic risk for any exposed WooCommerce store running an affected version is meaningful even without a public exploit yet, but it does not rise to drop-everything urgency.

An attacker scanning for WooCommerce stores fingerprints sites running WPC Product Bundles ≤ 8.5.3 and sends crafted unauthenticated HTTP requests directly to the vulnerable plugin endpoint, invoking a state-changing action that should have required an authenticated administrator. The result is tampered plugin or bundle data - for example modified bundle composition, pricing, or settings - which can be leveraged to alter what customers see and buy, with no public POC identified at time of analysis.