# YITH WooCommerce Product Bundles <= 2.30.0 - Unauthenticated Price Manipulation via Bundled Item Cart Quantity Update

- **ID:** WPSEC-2026-1321
- **Plugin:** YITH WooCommerce Product Bundles (`yith-woocommerce-product-bundles`), https://wordpress.org/plugins/yith-woocommerce-product-bundles/
- **Affected versions:** all versions before 2.30.1
- **Fixed in:** 2.30.1 (Update to 2.30.1 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-472
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/yith-woocommerce-product-bundles
- **Fix released:** 2026-10-19
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1321/

## Description

The YITH WooCommerce Product Bundles plugin for WordPress is vulnerable to price manipulation via the cart quantity update of bundled items in all versions up to, and including, 2.30.0. This is due to missing server-side validation when the quantity of a cart item that belongs to a bundle is changed through the classic cart update form. Bundled child items are priced at zero in the cart. This makes it possible for unauthenticated attackers to raise the quantity of bundled items and get extra units of those products without paying for them.

## References

- https://wpsec.com/vuln/WPSEC-2026-1321/
- https://plugins.svn.wordpress.org/yith-woocommerce-product-bundles/tags/2.30.1/
- https://wordpress.org/plugins/yith-woocommerce-product-bundles/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1321/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.