Woo Product Bundle Vulnerabilities

The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 8.5.3. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 8.5.3

Fixed in:

8.5.4

Disclosed:

Jun 1, 2026

CVE-2026-48883 on NVD →

The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 8.4.5. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 8.4.5

Fixed in:

8.4.6

Disclosed:

Feb 22, 2026

CVE-2026-32406 on NVD →

The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 7.3.1. This is due to missing or incorrect nonce validation on several functions in /includes/class-woosb.php. This makes it possible for unauthenticated attackers to update search...

CVSS:

4.3

Affected:

up to 7.3.1

Fixed in:

7.3.2

Disclosed:

Dec 28, 2023

CVE-2023-52127 on NVD →