This vulnerability (CVE-2026-48883) affects WPC Product Bundles for WooCommerce versions up to 8.5.3 and is classified as CWE-862 Missing Authorization. It allows unauthenticated attackers to bypass access controls, potentially leading to unauthorized modification or manipulation of product bundle data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. The vendor has not provided a patch or official remediation level as of the publication date.

The vulnerability allows unauthenticated attackers to bypass authorization controls, leading to high integrity impact. This means attackers could modify or manipulate product bundle configurations or data without proper permissions. There is no impact on confidentiality or availability reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected plugin's functionality and monitor for unusual activity related to product bundles. Avoid exposing administrative or bundle management interfaces to untrusted users.