WPC Product Bundles for WooCommerce <= 8.7.8 - Unauthenticated Bundle Validation Bypass via 'order_again' and 'data[woosb_ids]' Parameters
- ID
- WPSEC-2026-2769
- Plugin
- WPC Product Bundles for WooCommerce (woo-product-bundle)
- Affected
- all versions before 8.7.9
- Remediation
- Update to 8.7.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-20
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-10
- Attack surface
- WPC Product Bundles for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to a bundle add-to-cart validation bypass via the 'order_again' and 'data[woosb_ids]' request parameters in all versions up to, and including, 8.7.8. This is due to the add_to_cart_validation() function skipping all bundle checks whenever an 'order_again' request parameter is present, and validating only the 'woosb_ids' parameter while add_cart_item_data() builds the cart item from 'data[woosb_ids]'. This makes it possible for unauthenticated attackers to add bundles with arbitrary or empty contents and quantities to the cart. This bypasses the checks on bundled products, minimum and maximum quantities and purchasability, and can let them obtain products not in the bundle at the bundle's fixed price.
References
- https://wpsec.com/vuln/WPSEC-2026-2769/
- https://plugins.svn.wordpress.org/woo-product-bundle/tags/8.7.9/
- https://wordpress.org/plugins/woo-product-bundle/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS