BEAR woo-bulk-editor CVE-2026-45213

Requires valid WordPress administrator credentials (PR:H in CVSS vector). Exploitation possible only after successful authentication to WordPress admin dashboard with high-privilege account. BEAR woo-bulk-editor plugin must be installed and activated on the WordPress instance. Attack requires knowledge of WordPress database structure and blind SQL injection techniques to extract data without direct query output visibility. No user interaction required once admin access obtained (UI:N). Network-accessible WordPress admin interface (AV:N) enables remote exploitation. Limiting factor: high privilege barrier makes this primarily an insider threat or post-compromise escalation scenario rather than mass exploitation vector.

Real-world risk assessment reveals moderate-to-high severity but limited practical exploitability. CVSS 7.6 indicates high impact, but the PR:H (high privilege required) prerequisite restricts exploitation to users with WordPress administrator credentials, significantly narrowing the attack surface. The changed scope (S:C) elevates concern as attackers could pivot from the plugin to extract data from the broader WordPress database including user credentials, posts, or WooCommerce customer data. EPSS data not available in provided intelligence. No CISA KEV listing confirms no widespread active exploitation. Patchstack disclosure increases public awareness but no POC code explicitly referenced. Attack complexity is low (AC:L) once admin access obtained, making this a priority for environments where administrator accounts face compromise risk through credential stuffing, insider threats, or supply chain attacks. Primary risk driver is the privilege escalation potential from compromised admin accounts to full database access.

A compromised WordPress administrator account (obtained through phishing, credential reuse, or insider threat) logs into the WordPress dashboard and navigates to BEAR bulk editor functionality. The attacker crafts malicious input containing SQL injection payloads in bulk edit parameters, exploiting insufficient input validation. Using blind SQL injection techniques with time-based delays or boolean conditions, the attacker systematically extracts sensitive data from the WordPress database including user password hashes, customer PII from WooCommerce tables, or session tokens for privilege escalation to other accounts.