The VillaTheme Bopo – WooCommerce Product Bundle Builder plugin contains a missing authorization flaw (CWE-862) that allows an attacker to perform privileged actions on product bundles that should be restricted. The flaw enables modification of bundle configurations, access to bundle content, and potentially exposure of customer or product information by manipulating pricing or bundle composition.

VillaTheme Bopo – WooCommerce Product Bundle Builder, versions up to and including 1.2.3.

The CVSS score of 5.3 indicates moderate severity, and no EPSS score is available. The vulnerability is not listed in the CISA KEV catalog. Likely, an attacker could exploit the issue through a web request that does not require valid credentials or by leveraging an authenticated session lacking proper permissions. Currently, no public exploits are documented, suggesting limited known exploitation activity.