Vulnerabilities / YITH WooCommerce Product Bundles / WPSEC-2026-1321
YITH WooCommerce Product Bundles <= 2.30.0 - Unauthenticated Price Manipulation via Bundled Item Cart Quantity Update
Medium 5.3
CWE-472Fixed in 2.30.1
- ID
- WPSEC-2026-1321
- Plugin
- YITH WooCommerce Product Bundles (yith-woocommerce-product-bundles)
- Affected
- all versions before 2.30.1
- Remediation
- Update to 2.30.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-472
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-21
- Attack surface
- YITH WooCommerce Product Bundles on WPSec AttackSurface
- Fix released
- Published
Description
The YITH WooCommerce Product Bundles plugin for WordPress is vulnerable to price manipulation via the cart quantity update of bundled items in all versions up to, and including, 2.30.0. This is due to missing server-side validation when the quantity of a cart item that belongs to a bundle is changed through the classic cart update form. Bundled child items are priced at zero in the cart. This makes it possible for unauthenticated attackers to raise the quantity of bundled items and get extra units of those products without paying for them.
References
- https://wpsec.com/vuln/WPSEC-2026-1321/
- https://plugins.svn.wordpress.org/yith-woocommerce-product-bundles/tags/2.30.1/
- https://wordpress.org/plugins/yith-woocommerce-product-bundles/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS