CVE-2026-57664: Bopo WooCommerce Product Bundle Builder Data Exposure (MEDIUM)

Technical summary

CVE-2026-57664 is an authenticated information disclosure vulnerability (CWE-497: Exposure of Sensitive Data to an Unauthorized Actor) in Bopo WooCommerce Product Bundle Builder versions ≤1.1.6. The flaw allows any authenticated user on the WordPress instance to access sensitive data via the plugin without requiring administrative or special roles. The CVSS 3.1 score of 4.3 (Medium) reflects network-based attack surface, low attack complexity, and confidentiality impact limited to low severity. The vulnerability does not enable privilege escalation, data modification, or availability disruption.

Business impact

For e-commerce operations running affected Bopo versions, this vulnerability exposes business-sensitive information to any registered user—including employees, vendors, or low-privilege accounts. Potential exposure includes product configuration, pricing logic, bundle rules, or customer-related metadata depending on the plugin's data architecture. This could lead to competitive intelligence leakage, pricing strategy disclosure, or privacy concerns if customer-linked data is involved. The risk is contained to site users rather than external unauthenticated attackers, but the blast radius increases with the number of registered accounts.

Affected systems

WordPress installations using Bopo WooCommerce Product Bundle Builder plugin version 1.1.6 or earlier are affected. Any site with this plugin active and any user account (subscriber, contributor, customer, or higher) poses an exposure path. The vulnerability does not affect other WooCommerce product bundling solutions or plugins with different code paths.

Exploitability

Exploitation requires valid WordPress authentication credentials. An attacker must have an active user account on the target WordPress instance—either self-registered (if registrations are open) or provisioned by the site administrator. Once authenticated, no further user interaction or additional exploitation steps are required; access to the sensitive data is direct. External attackers without an account cannot exploit this issue, making it lower risk than unauthenticated flaws but still material in multi-user WordPress environments.

Remediation

Update Bopo WooCommerce Product Bundle Builder to a patched version beyond 1.1.6. Verify the specific version number against the vendor's release notes or advisory. As an interim measure, restrict user registration on WordPress, audit existing user accounts and revoke unnecessary access, and consider disabling the plugin until a patch is deployed if exposure risk is unacceptable. Monitor access logs for unusual information queries from low-privilege accounts.

Patch guidance

Check the official Bopo plugin repository or vendor advisory for the first patched release after version 1.1.6. Apply the update through WordPress's plugin management interface or manually replace plugin files. Test on a staging environment first to verify compatibility with your site's WooCommerce version and any bundled configurations. Confirm the vulnerability is resolved by checking the plugin version number in WordPress admin > Plugins after deployment.

Detection guidance

Identify affected installations by checking WordPress admin > Plugins for Bopo WooCommerce Product Bundle Builder and recording its version. Query your WordPress user table to count registered accounts—higher counts increase risk. Monitor wp-admin logs and API access logs for authenticated requests to the plugin's endpoints from non-administrative users, particularly looking for repeated information queries. Enable detailed logging in WordPress (if not already enabled) to capture post-update activity for baseline comparison.

Why prioritize this

Although the CVSS score is Medium (4.3), priority should be determined by your organization's user account posture. Sites with restricted user registration and primarily administrative accounts face lower practical risk. High-registration sites (open customer accounts, vendor portals) or those with sensitive product configurations should prioritize this patch earlier. The vulnerability is not actively exploited in the wild (not yet on CISA KEV list) and does not enable critical impact, but its ease of exploitation for authenticated users and potential business sensitivity of product bundle data warrant prompt attention.

Risk score, explained

CVSS 3.1 score of 4.3 reflects: network-accessible attack surface (AV:N), low attack complexity (AC:L), requirement for valid user authentication (PR:L), no user interaction needed (UI:N), single-system scope (S:U), and low confidentiality impact (C:L). The score does not account for business context—information sensitivity and user account proliferation are your organization's modifying factors.

Frequently asked questions