Executive Summary

CVE-2026-57664 is a vulnerability in the WordPress plugin "Bopo – WooCommerce Product Bundle Builder" version 1.1.6 or earlier. It allows unauthorized users to access sensitive data that should normally be protected and not visible to regular users.

This exposure of sensitive information can potentially lead to further exploitation of system weaknesses.

The vulnerability is classified under OWASP Top 10 A3: Sensitive Data Exposure and has a low severity impact with a CVSS score of 4.3.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing unauthorized users to access sensitive information on your website that should be protected.

Although the severity is low and exploitation is unlikely, attackers could still use mass-exploit campaigns to target websites using the vulnerable plugin.

Such exposure could lead to further attacks or misuse of the exposed data.

Immediate mitigation involves updating the plugin to version 1.2.0 or later, or enabling auto-updates if using Patchstack.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to update the Bopo – WooCommerce Product Bundle Builder plugin to version 1.2.0 or later.

Additionally, Patchstack users can enable auto-updates for vulnerable plugins to reduce the risk of exploitation.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability involves unauthenticated sensitive data exposure, which can lead to unauthorized access to sensitive information. Such exposure may impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive data from unauthorized access.

However, the provided information does not explicitly discuss the direct effects on compliance with these standards or any regulatory implications.

Useful 0 Not Useful 0