{"id":"CVE-2026-110377","kind":"vulnerability","aliases":["CVE-2026-110377"],"related":[],"title":"Bopo WooCommerce bundle builder: missing authorization check on WordPress plugin","description":"Missing Authorization vulnerability in VillaTheme Bopo – WooCommerce Product Bundle Builder bopo-woo-product-bundle-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bopo – WooCommerce Product Bundle Builder: from n/a through 1.2.3.","summary":"The Bopo WooCommerce Product Bundle Builder WordPress plugin, up to and including version 1.2.3, is missing an authorization check on some functionality. The sources do not say which action an attacker could take with it.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bopo-woo-product-bundle-builder","package","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the Bopo – WooCommerce Product Bundle Builder plugin (`bopo-woo-product-bundle-builder`) in the WordPress admin under Plugins.\n- Confirm whether the plugin is active on the site.","fix":"- Update the Bopo – WooCommerce Product Bundle Builder plugin to a version later than `1.2.3`; the sources do not name the fixed version.\n- If no fixed version is available, deactivate the plugin until one is released (unknown).","status":"open","published_at":"2026-10-26T10:16:51+00:00","first_seen_at":"2026-10-26T10:29:17+00:00","triaged_at":"2026-10-26T10:30:59+00:00","updated_at":"2026-10-26T10:30:59+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-26T10:30:59Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Bopo – WooCommerce Product Bundle Builder plugin to a version later than `1.2.3`; the sources do not name the fixed version.\n- If no fixed version is available, deactivate the plugin until one is released (unknown).","reach":"unknown","title":"Bopo WooCommerce bundle builder: missing authorization check on WordPress plugin","impact":"medium","summary":"The Bopo WooCommerce Product Bundle Builder WordPress plugin, up to and including version 1.2.3, is missing an authorization check on some functionality. The sources do not say which action an attacker could take with it.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","bopo-woo-product-bundle-builder"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Unauthorized users may perform actions the plugin should restrict.","analyst_note":"Check the NVD entry and the plugin's changelog for the fixed version and the affected endpoint, and confirm the required privilege level.","how_to_check":"- Check the installed version of the Bopo – WooCommerce Product Bundle Builder plugin (`bopo-woo-product-bundle-builder`) in the WordPress admin under Plugins.\n- Confirm whether the plugin is active on the site.","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Bopo – WooCommerce Product Bundle Builder plugin at version 1.2.3 or earlier are affected. The sources do not say which roles or endpoints are exposed, so the exact exposure is unknown. Sites without this plugin installed can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000644,"input_tokens":3338,"output_tokens":620,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110377':13A,16A '-2026':12A,15A '1.2.3':39B,93C 'access':79C 'action':54B 'affect':84C 'allow':75C 'attack':56B 'author':6A,43B,60C 'bopo':1A,18B,27B,64C,70C,85C 'bopo-woo-product-bundle-build':17B,69C 'builder':4A,22B,31B,68C,74C,89C 'bundl':3A,21B,30B,67C,73C,88C 'check':7A,44B 'configur':78C 'control':80C 'could':57B 'cve':11A,14A 'exploit':76C 'function':47B 'includ':37B 'incorrect':77C 'issu':83C 'levels.this':82C 'miss':5A,41B,59C 'n/a':91C 'packag':23B 'plugin':10A,33B 'product':20B,29B,66C,72C,87C 'say':52B 'secur':81C 'sourc':49B 'take':58B 'version':38B 'villathem':63C 'vulner':61C 'woo':19B,71C 'woocommerc':2A,24B,28B,65C,86C 'wordpress':9A,25B,32B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Bopo – WooCommerce Product Bundle Builder plugin at version 1.2.3 or earlier are affected. The sources do not say which roles or endpoints are exposed, so the exact exposure is unknown. Sites without this plugin installed can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T10:16:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110377","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110377","severity":null,"published_at":"2026-10-26T10:16:51+00:00","modified_at":"2026-10-26T10:16:51+00:00","first_seen_at":"2026-10-26T10:29:17+00:00","fetched_at":"2026-10-26T10:29:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}