# CVE-2026-57664: VillaTheme Bopo WooCommerce Product Bundle Builder sensitive data exposure

Source: https://junglewise.ai/threats/cve-2026-57664-villatheme-bopo-woocommerce-product-bundle-builder-sensitive-data  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-57664 · Severity: medium · CVSS 4.3 · Published 2026-06-26

Bopo is a WordPress plugin used by e-commerce sites to create custom product bundles in WooCommerce. A security flaw in this plugin allows unauthorized individuals to access sensitive system information that should be restricted. This exposure could provide attackers with technical details needed to facilitate further, more complex attacks against the website.

Technologies: [VillaTheme Bopo](https://junglewise.ai/threats/technologies/bopo). Vendors: [VillaTheme](https://junglewise.ai/threats/vendors/villatheme).

## Quick answers

**Is CVE-2026-57664 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57664 being exploited in the wild.

**How severe is CVE-2026-57664?** Medium severity, with a CVSS score of 4.3, published 26 June 2026.

**Which products and versions are affected?** VillaTheme Bopo <= 1.1.6.

**Is there a fix for CVE-2026-57664?** A patch was published on 1.2.0: Vulnerability fixed in version 1.2.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57664 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-57664?** Check whether you run VillaTheme Bopo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Bopo – WooCommerce Product Bundle Builder plugin for WordPress is vulnerable to Sensitive Data Exposure (CWE-497) in versions up to 1.1.6. The vulnerability stems from improper control of sensitive system information, allowing unauthenticated or low-privileged users to view data that is normally restricted. While the CVSS vector provided by the CNA (Patchstack) indicates a 'Low' privilege requirement (PR:L), the advisory title and description explicitly state the vulnerability is 'Unauthenticated.' An attacker can exploit this over the network without user interaction to gather information that could assist in further exploitation. The issue is resolved in version 1.2.0.

## Affected products

- VillaTheme Bopo – WooCommerce Product Bundle Builder <= 1.1.6

## Timeline

- 2026-02-21: other: Reported by Bao - BlueRock
- 2026-06-26: disclosed: Early warning sent to Patchstack customers
- 2026-06-26: advisory: Publicly published by Patchstack and NVD
- 1.2.0: patched: Vulnerability fixed in version 1.2.0

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/bopo-woo-product-bundle-builder/vulnerability/wordpress-bopo-woocommerce-product-bundle-builder-plugin-1-1-6-sensitive-data-exposure-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/bopo-woo-product-bundle-builder/vulnerability/wordpress-bopo-woocommerce-product-bundle-builder-plugin-1-1-6-sensitive-data-exposure-vulnerability?_s_id=cve)