CVE-2026-105878

MediumCVSS 5.3

Published: 08/10/2026(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Summary

Missing authorization in YITH WooCommerce Product Bundles (up to 2.29.0) allows exploiting incorrectly configured access control security levels.

Risk Assessment

Unauthorized users may access bundle management functions, potentially leading to unauthorized changes.

Recommendation

Update the plugin to a patched version.

Other vulnerabilities in YITH WooCommerce Product Bundles

CVE-2026-111845Medium
The YITH WooCommerce Product Bundles plugin up to version 2.29.0 has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may perform actions requiring higher privileges.

Original NVD description (English source)

Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS