CVE-2026-57664: Bopo Plugin Information Disclosure Flaw

CVE-2026-57664 Overview

CVE-2026-57664 is a sensitive data exposure vulnerability in the Bopo – WooCommerce Product Bundle Builder plugin for WordPress, affecting versions up to and including 1.1.6. The flaw is categorized under [CWE-497] (Exposure of Sensitive System Information to an Unauthorized Control Sphere) and allows an authenticated attacker with low privileges to retrieve information that should not be accessible.

The vulnerability requires network access and low-complexity exploitation, but is limited to confidentiality impact only. No integrity or availability effects have been documented.

Critical Impact
Low-privileged users on affected WordPress sites can retrieve sensitive plugin data, potentially exposing store configuration or bundle information that should remain protected.

Affected Products

Bopo – WooCommerce Product Bundle Builder plugin, versions ≤ 1.1.6
WordPress sites running WooCommerce with the vulnerable plugin installed
Any store configuration data accessible through the vulnerable endpoint

Discovery Timeline

2026-06-26 - CVE-2026-57664 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-57664

Vulnerability Analysis

The vulnerability resides in the Bopo – WooCommerce Product Bundle Builder plugin distributed for WordPress. According to the Patchstack Vulnerability Report, the plugin exposes sensitive data to actors who should not have access to it.

The issue is classified as [CWE-497], indicating the plugin returns internal or system-level information through interfaces that lack sufficient authorization enforcement. An attacker with a low-privilege account, such as a subscriber-level user, can query the affected functionality and receive data intended for administrators or trusted store operators.

The exposure is limited to confidentiality. The vulnerability does not allow modification of data or disruption of service. However, the retrieved information may facilitate further reconnaissance or targeted attacks against the WooCommerce store.

Root Cause

The root cause is missing or insufficient authorization checks on plugin endpoints that return sensitive plugin or store configuration data. The plugin does not validate whether the requesting user holds the capability required to view the requested resource before returning it.

Attack Vector

Exploitation occurs over the network against the WordPress site. The attacker must authenticate with at least a low-privilege account. No user interaction is required, and the attack complexity is low. The vulnerability details do not include a publicly released proof-of-concept exploit. Refer to the Patchstack advisory for additional technical context.

Detection Methods for CVE-2026-57664

Indicators of Compromise

Unexpected HTTP requests from low-privileged accounts to plugin-specific admin-ajax or REST API endpoints associated with bopo-woo-product-bundle-builder.
Access log entries showing repeated queries to plugin endpoints originating from non-administrative user sessions.
Outbound data exfiltration patterns following successful reconnaissance against the WooCommerce store.

Detection Strategies

Inventory WordPress installations and identify sites running the Bopo – WooCommerce Product Bundle Builder plugin at version 1.1.6 or earlier.
Enable WordPress and WooCommerce audit logging to capture authenticated requests made against plugin endpoints.
Correlate low-privileged account activity with responses containing larger-than-expected payloads or administrative-only fields.

Monitoring Recommendations

Monitor web server logs for authenticated requests to plugin routes tied to bundle configuration.
Alert on unusual API access patterns from subscriber or customer accounts on WooCommerce sites.
Review new user registrations for anomalous behavior that could indicate opportunistic account creation for exploitation.

How to Mitigate CVE-2026-57664

Immediate Actions Required

Identify all WordPress instances running the Bopo – WooCommerce Product Bundle Builder plugin and confirm the installed version.
Update the plugin to a version later than 1.1.6 once a vendor-supplied fix is available through the WordPress plugin repository.
Restrict new account registrations on WooCommerce stores if not strictly required for business operations.

Patch Information

At the time of publication, refer to the Patchstack Vulnerability Report for the latest patch availability and remediation guidance. Apply the vendor update as soon as a fixed release is published.

Workarounds

Deactivate the Bopo – WooCommerce Product Bundle Builder plugin until an updated version is installed.
Use a Web Application Firewall (WAF) rule to block requests from low-privileged users to the affected plugin endpoints.
Audit and remove unused or dormant low-privilege user accounts that could be leveraged for exploitation.

bash

# Example: list active WordPress plugins and versions using WP-CLI
wp plugin list --status=active --fields=name,version,status

# Deactivate the vulnerable plugin as a temporary workaround
wp plugin deactivate bopo-woo-product-bundle-builder