An unauthenticated sensitive data exposure flaw exists in the WordPress Bopo – WooCommerce Product Bundle Builder plugin versions up to 1.1.6. Because the plugin does not properly restrict access to certain internal data, an attacker who can reach the plugin’s endpoints can read confidential information stored or managed by the plugin. This flaw is classified as CWE‑497, which reflects an exposure of sensitive information due to insufficient privileges or authentication controls.

The vulnerability affects the Bopo – WooCommerce Product Bundle Builder plugin developed by VillaTheme. All WordPress installations running a version of this plugin that is 1.1.6 or earlier are impacted. The vendor recommendation is to upgrade to at least version 1.2.0, the earliest release that contains the fix.

The CVSS score of 4.3 indicates a moderate severity level. Because the issue requires no authentication, the attack surface is open to any user on the site, though the specific data that can be accessed depends on the plugin’s configuration. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalogue, suggesting that mass exploitation is not widely observed yet. Nonetheless, the potential confidentiality impact warrants prompt action.