Unauthenticated Sensitive Data Exposure in Bopo WooCommerce Product Bundle Builder

Executive Summary

CVE-2026-57664 is a vulnerability in the WordPress plugin "Bopo – WooCommerce Product Bundle Builder" version 1.1.6 or earlier. It allows unauthorized users to access sensitive data that should normally be protected and not visible to regular users.

This exposure of sensitive information can potentially lead to further exploitation of system weaknesses.

The vulnerability is classified under OWASP Top 10 A3: Sensitive Data Exposure and has a low severity impact with a CVSS score of 4.3.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects the WordPress plugin "Bopo – WooCommerce Product Bundle Builder" version 1.1.6 or earlier. Detection involves identifying if this vulnerable plugin version is installed on your WordPress site.

To detect the vulnerability on your system, you can check the installed plugin version via WordPress admin dashboard or by inspecting the plugin files directly.

Suggested commands to detect the vulnerable plugin version on a server with command line access include:

• Navigate to the WordPress plugins directory, usually at wp-content/plugins/bopo-woocommerce-product-bundle-builder/
• Run the command: cat bopo-woocommerce-product-bundle-builder.php | grep 'Version' to find the plugin version.
• Alternatively, use WP-CLI if available: wp plugin list --status=active | grep bopo to check the installed version.

If the version is 1.1.6 or below, the system is vulnerable and should be updated to version 1.2.0 or later.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing unauthorized users to access sensitive information on your website that should be protected.

Although the severity is low and exploitation is unlikely, attackers could still use mass-exploit campaigns to target websites using the vulnerable plugin.

Such exposure could lead to further attacks or misuse of the exposed data.

Immediate mitigation involves updating the plugin to version 1.2.0 or later, or enabling auto-updates if using Patchstack.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability involves unauthenticated sensitive data exposure, which can lead to unauthorized access to sensitive information. Such exposure may impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive data from unauthorized access.

However, the provided information does not explicitly discuss the direct effects on compliance with these standards or any regulatory implications.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to update the Bopo – WooCommerce Product Bundle Builder plugin to version 1.2.0 or later.

Additionally, Patchstack users can enable auto-updates for vulnerable plugins to reduce the risk of exploitation.

Useful 0 Not Useful 0