What is the CVSS score of CVE-2026-1673?

CVE-2026-1673 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-1673

EUVD-2026-20441 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-04-08 Wordfence

GHSA-mwv2-4r83-7wmm

WordPress CSRF

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 11:46 euvd

EUVD-2026-20441

Analysis Generated

Apr 08, 2026 - 11:46 vuln.today

CVE Published

Apr 08, 2026 - 11:16 nvd

MEDIUM 4.3

DescriptionCVE.org

The BEAR - Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.5. This is due to missing nonce validation on the woobe_delete_tax_term() function. This makes it possible for unauthenticated attackers to delete WooCommerce taxonomy terms (categories, tags, etc.) via a forged request granted they can trick a site administrator or shop manager into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery in BEAR - Bulk Editor and Products Manager Professional for WooCommerce (all versions up to 1.1.5) allows unauthenticated attackers to delete WooCommerce taxonomy terms via a malicious link that tricks site administrators or shop managers into performing an action. The vulnerability stems from missing nonce validation on the woobe_delete_tax_term() function, enabling integrity compromise with low CVSS impact (4.3) but requiring user interaction.

Technical ContextAI

This is a Cross-Site Request Forgery (CSRF) vulnerability classified under CWE-352, affecting the BEAR WordPress plugin for WooCommerce. The woobe_delete_tax_term() function fails to implement WordPress nonce validation mechanisms, which are cryptographic tokens that verify legitimate server-originated requests. Without nonce checks, an attacker can craft a forged HTTP request that, when executed by an authenticated site administrator or shop manager (who has the capability to delete taxonomy terms), will delete arbitrary WooCommerce categories, tags, or other taxonomy terms. The vulnerability exploits the trust that browsers place in authenticated sessions-when an admin visits a malicious website, the browser automatically includes their WordPress session cookies, allowing the attacker's JavaScript to perform unauthorized actions on the victim's WordPress installation.

RemediationAI

Site administrators should update the BEAR plugin to a version newer than 1.1.5, which includes nonce validation fixes per changesets 3457263 and 3465138 in the WordPress Plugin Directory repository. Patch details are available in the official Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/1e4e8960-b0c1-4dbb-ba97-e45b88fb06c0?source=cve). As a temporary workaround pending plugin update, site administrators should limit link-clicking from untrusted sources and educate users about CSRF risks; however, upgrading the plugin is the definitive remediation and should be prioritized.