{
 "id": "WPSEC-2026-2769",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2769/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2769/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2769/index.md",
 "title": "WPC Product Bundles for WooCommerce <= 8.7.8 - Unauthenticated Bundle Validation Bypass via 'order_again' and 'data[woosb_ids]' Parameters",
 "description": "The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to a bundle add-to-cart validation bypass via the 'order_again' and 'data[woosb_ids]' request parameters in all versions up to, and including, 8.7.8. This is due to the add_to_cart_validation() function skipping all bundle checks whenever an 'order_again' request parameter is present, and validating only the 'woosb_ids' parameter while add_cart_item_data() builds the cart item from 'data[woosb_ids]'. This makes it possible for unauthenticated attackers to add bundles with arbitrary or empty contents and quantities to the cart. This bypasses the checks on bundled products, minimum and maximum quantities and purchasability, and can let them obtain products not in the bundle at the bundle's fixed price.",
 "plugin": {
  "slug": "woo-product-bundle",
  "name": "WPC Product Bundles for WooCommerce",
  "full_name": "WPC Product Bundles for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/woo-product-bundle/",
  "advisories_url": "https://wpsec.com/vuln/plugin/woo-product-bundle/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/woo-product-bundle"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-20"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "8.7.9",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 8.7.9"
  ]
 },
 "introduced_in": null,
 "fixed_in": "8.7.9",
 "remediation": "Update to 8.7.9 or later.",
 "fix_released": "2026-11-09T07:07:32+00:00",
 "published": "2026-11-10T07:51:46+00:00",
 "updated": "2026-11-09T23:33:37.041688+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2769/",
  "https://plugins.svn.wordpress.org/woo-product-bundle/tags/8.7.9/",
  "https://wordpress.org/plugins/woo-product-bundle/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/woo-product-bundle",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-10"
 }
}