{
 "id": "WPSEC-2026-1321",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1321/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1321/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1321/index.md",
 "title": "YITH WooCommerce Product Bundles <= 2.30.0 - Unauthenticated Price Manipulation via Bundled Item Cart Quantity Update",
 "description": "The YITH WooCommerce Product Bundles plugin for WordPress is vulnerable to price manipulation via the cart quantity update of bundled items in all versions up to, and including, 2.30.0. This is due to missing server-side validation when the quantity of a cart item that belongs to a bundle is changed through the classic cart update form. Bundled child items are priced at zero in the cart. This makes it possible for unauthenticated attackers to raise the quantity of bundled items and get extra units of those products without paying for them.",
 "plugin": {
  "slug": "yith-woocommerce-product-bundles",
  "name": "YITH WooCommerce Product Bundles",
  "full_name": "YITH WooCommerce Product Bundles",
  "wordpress_org": "https://wordpress.org/plugins/yith-woocommerce-product-bundles/",
  "advisories_url": "https://wpsec.com/vuln/plugin/yith-woocommerce-product-bundles/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/yith-woocommerce-product-bundles"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-472"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.30.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.30.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.30.1",
 "remediation": "Update to 2.30.1 or later.",
 "fix_released": "2026-10-19T14:08:21+00:00",
 "published": "2026-10-21T10:43:36+00:00",
 "updated": "2026-10-21T10:36:18.427702+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1321/",
  "https://plugins.svn.wordpress.org/yith-woocommerce-product-bundles/tags/2.30.1/",
  "https://wordpress.org/plugins/yith-woocommerce-product-bundles/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/yith-woocommerce-product-bundles",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-21"
 }
}