This vulnerability (CVE-2026-57664) affects Bopo – WooCommerce Product Bundle Builder versions up to 1.1.6 and involves unauthenticated exposure of sensitive data, classified under CWE-497. The CVSS 3.1 base score is 4.3, indicating medium severity with network attack vector, low attack complexity, and no user interaction required. The vulnerability allows unauthorized parties to access sensitive system information without authentication. No vendor advisory or patch information is currently provided, and no known exploits have been reported.

An unauthenticated attacker can gain access to sensitive system information from affected versions of the plugin, potentially aiding further attacks or information gathering. The impact is limited to confidentiality as per the CVSS vector, with no integrity or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the affected plugin or monitoring for unusual access patterns related to the plugin. Avoid exposing the plugin to untrusted networks if possible.