CVE-2026-111845

MediumCVSS 5.3

Published: 19/10/2026(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Summary

The YITH WooCommerce Product Bundles plugin up to version 2.29.0 has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may perform actions requiring higher privileges.

Risk Assessment

This could allow unauthorized operations on products or store configuration, leading to data integrity violations.

Recommendation

Update the YITH WooCommerce Product Bundles plugin to a version later than 2.29.0 and review user role permissions.

Other vulnerabilities in YITH WooCommerce Product Bundles

CVE-2026-105878Medium
Missing authorization in YITH WooCommerce Product Bundles (up to 2.29.0) allows exploiting incorrectly configured access control security levels.

Original NVD description (English source)

Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS