Medium · 5.3 CVE-2026-105878 EUVD-2026-94931GHSA-jf8c-ggfw-p2rg

WordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerability

Published Oct 8, 2026 · Updated Oct 8, 2026 · Assigned by Patchstack

Vendor: Yith Product: YITH WooCommerce Product Bundles Category: Web / CMS

Description

Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0.

Affected products

Vendor	Product	Affected	Fixed
YITH	YITH WooCommerce Product Bundles	≤ 2.29.0	—

References

https://patchstack.com/database/wordpress/plugin/yith-woocommerce-product-bundles/vulnerability/wordpress-yith-woocommerce-product-bundles-plugin-2-29-0-broken-access-control-vulnerability?_s_id=cve vdb-entry