# WPC Product Bundles for WooCommerce <= 8.7.8 - Unauthenticated Bundle Validation Bypass via 'order_again' and 'data[woosb_ids]' Parameters

- **ID:** WPSEC-2026-2769
- **Plugin:** WPC Product Bundles for WooCommerce (`woo-product-bundle`), https://wordpress.org/plugins/woo-product-bundle/
- **Affected versions:** all versions before 8.7.9
- **Fixed in:** 8.7.9 (Update to 8.7.9 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-20
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-10)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/woo-product-bundle
- **Fix released:** 2026-11-09
- **Published:** 2026-11-10
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2769/

## Description

The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to a bundle add-to-cart validation bypass via the 'order_again' and 'data[woosb_ids]' request parameters in all versions up to, and including, 8.7.8. This is due to the add_to_cart_validation() function skipping all bundle checks whenever an 'order_again' request parameter is present, and validating only the 'woosb_ids' parameter while add_cart_item_data() builds the cart item from 'data[woosb_ids]'. This makes it possible for unauthenticated attackers to add bundles with arbitrary or empty contents and quantities to the cart. This bypasses the checks on bundled products, minimum and maximum quantities and purchasability, and can let them obtain products not in the bundle at the bundle's fixed price.

## References

- https://wpsec.com/vuln/WPSEC-2026-2769/
- https://plugins.svn.wordpress.org/woo-product-bundle/tags/8.7.9/
- https://wordpress.org/plugins/woo-product-bundle/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2769/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.