{"id":"CVE-2026-111845","kind":"vulnerability","aliases":["CVE-2026-111845"],"related":[],"title":"YITH WooCommerce Product Bundles: missing authorization check through version 2.29.0","description":"Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0.","summary":"The YITH WooCommerce Product Bundles plugin for WordPress lacks an authorization check on at least one action, so a user may reach functionality they should not. The sources say the flaw comes from incorrectly configured access control levels and affects all versions through 2.29.0.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","woocommerce","wordpress","yith"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in WordPress admin under Plugins, or with `wp plugin get yith-woocommerce-product-bundles --field=version`\n- Confirm whether the plugin is active on the site","fix":"- Update yith-woocommerce-product-bundles to a version later than `2.29.0` once the vendor publishes a fixed release (the sources do not name one)\n- Until a fix is available, unknown","status":"open","published_at":"2026-10-19T13:16:56+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:25:13+00:00","updated_at":"2026-10-25T04:25:13+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:25:13Z","model":"claude-haiku-5-5","output":{"fix":"- Update yith-woocommerce-product-bundles to a version later than `2.29.0` once the vendor publishes a fixed release (the sources do not name one)\n- Until a fix is available, unknown","reach":"internet","title":"YITH WooCommerce Product Bundles: missing authorization check through version 2.29.0","impact":"medium","summary":"The YITH WooCommerce Product Bundles plugin for WordPress lacks an authorization check on at least one action, so a user may reach functionality they should not. The sources say the flaw comes from incorrectly configured access control levels and affects all versions through 2.29.0.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","yith"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown access to restricted plugin functions on the store","analyst_note":"Read the NVD entry and the YITH changelog to find which action lacks the check, the required role, and the first fixed version; the sources give only 'through 2.29.0'.","how_to_check":"- Check the installed plugin version in WordPress admin under Plugins, or with `wp plugin get yith-woocommerce-product-bundles --field=version`\n- Confirm whether the plugin is active on the site","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the YITH WooCommerce Product Bundles plugin at version `2.29.0` or earlier, which is a WooCommerce store add-on. Sites without this plugin installed, or running a later version, are not affected. Whether a low-privilege user can exploit it on a given store depends on the specific missing check, which the sources do not describe.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000642,"input_tokens":3332,"output_tokens":617,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111845':13A,16A '-2026':12A,15A '2.29.0':10A,64B,96C 'access':56B,83C 'action':37B 'affect':60B,88C 'allow':79C 'author':6A,31B,66C 'bundl':4A,25B,73C,78C,92C 'check':7A,32B 'come':52B 'configur':55B,82C 'control':57B,84C 'cve':11A,14A 'exploit':80C 'flaw':51B 'function':43B 'incorrect':54B,81C 'issu':87C 'lack':29B 'least':35B 'level':58B 'levels.this':86C 'may':41B 'miss':5A,65C 'n/a':94C 'one':36B 'packag':17B 'plugin':26B 'product':3A,24B,72C,77C,91C 'reach':42B 'say':49B 'secur':85C 'sourc':48B 'user':40B 'version':9A,62B 'vulner':67C 'woocommerc':2A,18B,23B,71C,76C,90C 'wordpress':19B,28B 'yith':1A,20B,22B,69C,70C,75C,89C 'yith-woocommerce-product-bundl':74C","nicknames":[],"mitigations":[],"who_affected":"Sites running the YITH WooCommerce Product Bundles plugin at version `2.29.0` or earlier, which is a WooCommerce store add-on. Sites without this plugin installed, or running a later version, are not affected. Whether a low-privilege user can exploit it on a given store depends on the specific missing check, which the sources do not describe.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T13:16:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111845","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111845","severity":null,"published_at":"2026-10-19T13:16:56+00:00","modified_at":"2026-10-19T17:17:04+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}