---
id: "CVE-2026-110377"
kind: "vulnerability"
aliases: ["CVE-2026-110377"]
title: "Bopo WooCommerce bundle builder: missing authorization check on WordPress plugin"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["bopo-woo-product-bundle-builder", "package", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-26T10:16:51+00:00"
first_seen_at: "2026-10-26T10:29:17+00:00"
updated_at: "2026-10-26T10:30:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110377", "first_seen_at": "2026-10-26T10:29:17+00:00"}]
---

# Bopo WooCommerce bundle builder: missing authorization check on WordPress plugin

The Bopo WooCommerce Product Bundle Builder WordPress plugin, up to and including version 1.2.3, is missing an authorization check on some functionality. The sources do not say which action an attacker could take with it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Bopo – WooCommerce Product Bundle Builder plugin (`bopo-woo-product-bundle-builder`) in the WordPress admin under Plugins.
- Confirm whether the plugin is active on the site.

## Fix

- Update the Bopo – WooCommerce Product Bundle Builder plugin to a version later than `1.2.3`; the sources do not name the fixed version.
- If no fixed version is available, deactivate the plugin until one is released (unknown).

## Timeline

- 2026-10-26T10:29:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110377

## From the sources

Missing Authorization vulnerability in VillaTheme Bopo – WooCommerce Product Bundle Builder bopo-woo-product-bundle-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bopo – WooCommerce Product Bundle Builder: from n/a through 1.2.3.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_