The vulnerability is a missing authorization flaw in the WPC Product Bundles for WooCommerce plugin, allowing attackers to bypass intended access controls and target privileged endpoints. This flaw can enable an unauthenticated or low‑privilege user to view, modify, or delete bundled product configurations, potentially compromising the integrity of the site’s product data. The weakness is described as CWE-862: Missing Authorization.

The affected product is WPC Product Bundles for WooCommerce from vendor WPClever. All releases—from the initial build through version 8.4.5 inclusive—are impacted. No fixes are noted for later versions in the provided data.

The CVSS score of 4.3 indicates a moderate severity. An EPSS score of less than 1% reflects a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote web request performed by an unauthenticated or role‑limited user who can trigger plugin endpoints that lack proper capability checks.