Bear Bulk Editor And Products Manager Professional For Woocommerce By Pluginus Net EUVD-2026-20439

The CVSS 6.5 score (Medium-High) reflects a network-accessible vulnerability with no special complexity, no authentication required from the attacker's perspective, and high integrity impact (product data modification). However, the CVSS User Interaction (UI:R) requirement and low confidentiality/availability impact temper the severity. The real-world risk depends on site context: e-commerce sites with sensitive pricing or promotional data face elevated risk, as price manipulation or false product descriptions could cause financial harm or customer trust damage. The attack surface is limited by the attacker's need to socially engineer an administrator or shop manager-not arbitrary users. No EPSS score, public proof-of-concept code, or CISA KEV (active exploitation) was provided, suggesting this remains a theoretical threat at the time of analysis. For shops using this plugin, the integrity impact is material (prices can be changed without authorization), warranting prompt patching. For shops unaware of using this plugin, discovery and remediation should be prioritized given the ease of exploitation (AC:L) once a victim is compromised.

An attacker crafts a malicious HTML page containing a hidden form that targets the woobe_redraw_table_row() endpoint with forged parameters to modify product prices or descriptions. The attacker distributes this page via email or social media, tricking a WooCommerce shop administrator into visiting while logged into the WordPress dashboard. The browser automatically submits the hidden form with the victim's valid session cookies, and the plugin processes the request without validating a nonce, allowing the attacker to change product data such as prices, stock levels, or descriptions without the administrator's knowledge. No public proof-of-concept code has been identified at the time of analysis, but the vulnerability is straightforward to exploit given the network accessibility and low complexity.