Live › vulnerability › CVE-2026-111845
Go to dashboardThe YITH WooCommerce Product Bundles plugin for WordPress lacks an authorization check on at least one action, so a user may reach functionality they should not. The sources say the flaw comes from incorrectly configured access control levels and affects all versions through 2.29.0.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the YITH WooCommerce Product Bundles plugin at version or earlier, which is a WooCommerce store add-on. Sites without this plugin installed, or running a later version, are not affected. Whether a low-privilege user can exploit it on a given store depends on the specific missing check, which the sources do not describe.
2.29.0No product ranges from the sources yet.
wp plugin get yith-woocommerce-product-bundles --field=version2.29.0 once the vendor publishes a fixed release (the sources do not name one)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-111845")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.