The vulnerability is a missing authorization flaw that permits an attacker to exploit incorrectly configured access control in the YITH WooCommerce Product Bundles plugin. An attacker who can reach the plugin’s management interface could add, edit or delete product bundles without proper permission checks, potentially altering store offerings or pricing. The weakness is a classic broken access control issue (CWE‑862).

YITH’s WooCommerce plugin, YITH WooCommerce Product Bundles, is vulnerable for all releases up to and including version 2.29.0; no later versions are affected.

The CVSS score of 5.3 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to achieve web access to a WordPress site running the affected plugin; once the plugin’s admin area is reached, the lack of proper permissions allows privileged actions. The exploit is straightforward and does not require advanced conditions beyond reaching the plugin interface.