This vulnerability (CVE-2026-49110) in the WP Swings Upsell Order Bump Offer for WooCommerce plugin is classified under CWE-1284 (Improper Validation of Specified Quantity in Input). It affects versions up to 3.1.4 and allows unauthenticated attackers to bypass authentication mechanisms related to order bump offers by exploiting improper input validation. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No official patch or remediation guidance is currently available from the vendor or advisory sources.

The vulnerability allows unauthenticated attackers to manipulate the order bump offer process, potentially altering order quantities or details without proper authorization. This compromises the integrity of orders processed through the affected plugin, which could lead to fraudulent transactions or incorrect order fulfillment. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently documented, users should monitor vendor communications for updates. Until a patch is available, consider disabling or restricting access to the Upsell Order Bump Offer for WooCommerce plugin to mitigate risk.