CVE-2026-93836

This plugin has a flaw in the field where customers enter how many items they want to buy. An attacker can disguise malicious code as a number in that field, and the website stores it without cleaning it out — like a poisoned sticky note that activates and runs commands whenever a staff member later looks at the order. Attackers are already using this to sneak in and create secret admin accounts, essentially handing themselves a hidden master key to the store.

This matters to you if you run a WooCommerce store using the WPC Product Bundles for WooCommerce plugin, version 8.6.6 or earlier. It is reachable by anyone on the internet without needing an account on your site, and the malicious code specifically targets whoever has admin access when they view the affected order or product page.

Attackers are already exploiting this in the wild, using it to create hidden admin accounts and install backdoors on WooCommerce stores — this is confirmed, ongoing activity, not a theoretical risk. Because there is no vendor patch yet, every day the plugin stays active is a day of real exposure. Act now rather than waiting for a fix.

1. Identify whether WPC Product Bundles for WooCommerce is installed and confirm the version is ≤8.6.6 — check order item metadata for the '_woosb_ids' key for signs of injected payloads (e.g., numeric-prefixed strings followed by HTML/script tags like '1').
2. No patched version has been published yet per available findings — monitor the plugin's WordPress.org changelog closely for a fix.
3. As an interim mitigation, disable or remove the plugin, add a WAF rule blocking script-tag/event-handler payloads in the 'qty' parameter, and/or apply output escaping on affected fields via a code snippet if you must keep the plugin active.
4. Audit wp_users for unauthorized administrator accounts and audit the plugins directory for unrecognized/malicious plugins installed since October 4, 2026 (first reported exploitation date).
5. Rotate admin credentials and any API keys/secrets that may have been exposed via compromised admin sessions.
6. Not in CISA KEV at this time, so no federal remediation deadline applies, but treat with KEV-level urgency given confirmed in-the-wild exploitation.
7. Monitor site integrity scanners, outbound connections to unfamiliar infrastructure, and WordPress admin login logs for anomalies going forward.

CVSS 7.2 (High) — Network attack vector, no privileges or user interaction required, scope change with low confidentiality/integrity impact (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N). Weakness is CWE-79 (stored XSS), rooted in insufficient sanitization: a float-cast check on the 'qty' parameter allows numeric-prefixed payloads to pass validation while the trailing HTML/script payload is preserved and persisted in order metadata ('_woosb_ids'). No public PoC exploit code is on record, but news telemetry confirms active in-the-wild exploitation since 2026-10-04, delivering a post-exploitation implant that creates hidden admin accounts, installs malicious plugins, and establishes C2 persistence. Not currently listed in CISA KEV. EPSS prediction is low and flat, but is superseded by confirmed exploitation per verdict precedence. No vendor patch is currently available.