CVE-2026-1672
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The BEAR – Bulk Editor and Products Manager Professional plugin for WordPress up to version 1.1.5 is vulnerable to CSRF due to missing nonce validation in the woobe_redraw_table_row() function, allowing unauthenticated attackers to trick admins into updating WooCommerce product data.
Risk Assessment
The organization risks unauthorized modification of WooCommerce product data, potentially causing financial loss and customer trust issues.
Recommendation
Update the BEAR plugin to the latest version. Educate administrators about the risks of clicking suspicious links.
Other vulnerabilities in BEAR – Bulk Editor and Products Manager Professional for WooCommerce
Original NVD description (English source)
The BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.5. This is due to missing nonce validation on the woobe_redraw_table_row() function. This makes it possible for unauthenticated attackers to update WooCommerce product data including prices, descriptions, and other product fields via a forged request granted they can trick a site administrator or shop manager into performing an action such as clicking on a link.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS