CVE-2026-57664
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The vulnerability in the Bopo – WooCommerce Product Bundle Builder plugin version 1.1.6 and earlier allows unauthenticated attackers to access sensitive data. The flaw is due to insufficient protection of API endpoints or data exposure mechanisms.
Risk Assessment
The organization is at risk of leaking confidential information such as customer data, product configurations, or API keys, which could lead to privacy breaches and financial losses.
Recommendation
Immediately update the Bopo – WooCommerce Product Bundle Builder plugin to the latest available version that fixes this vulnerability. If an update is not possible, temporarily disable the plugin or restrict access to its endpoints using a firewall.
Other vulnerabilities in Bopo – WooCommerce Product Bundle Builder <= 1.1.6
See all- CVE-2026-110377Medium
The Bopo – WooCommerce Product Bundle Builder plugin (up to version 1.2.3) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This may enable unauthenticated users to access restricted functionality.
- CVE-2026-57422High
The Bopo – WooCommerce Product Bundle Builder plugin for WordPress contains a reflected XSS (Cross-site Scripting) vulnerability due to improper input neutralization during page generation. The issue affects versions up to and including 1.2.0.
Original NVD description (English source)
Unauthenticated Sensitive Data Exposure in Bopo – WooCommerce Product Bundle Builder <= 1.1.6 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS