Bear Bulk Editor And Products Manager Professional For Woocommerce By Pluginus Net
EUVD-2026-20441
|
CVE-2026-1673
MEDIUM
GHSA-mwv2-4r83-7wmm
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Anti-CSRF tokens, SameSite cookies
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS score of 4.3 reflects low real-world risk despite CSRF's inherent severity. The attack vector is network-based and requires no privileges or system complexity, but the critical requirement is user interaction (UI:R)-an administrator must click a link or visit a page controlled by the attacker. The integrity impact (I:L) is limited to deletion of taxonomy terms, not wholesale site compromise or data exfiltration. No EPSS score, POC code, or CISA KEV status is indicated in the provided data, suggesting this is not a high-priority target for mass exploitation. However, for WordPress sites with strict content management policies, unauthorized taxonomy deletion could cause operational disruption. The real-world risk is moderate and depends on whether the site has social engineering-vulnerable administrators and whether attackers would prioritize this specific plugin. |
| Exploit ScenarioDerived | An attacker crafts a malicious webpage containing a hidden form or JavaScript that, when visited by a logged-in WordPress site administrator, automatically submits a request to delete specific WooCommerce taxonomy terms. The attacker could distribute this page via email, phishing, or social media, and when the administrator visits it (while authenticated to their WordPress dashboard in another browser tab), the forged request executes with the admin's privileges. The taxonomy terms are deleted without the administrator's awareness or consent. No public exploit code has been identified at time of analysis, and no active exploitation (KEV status) is confirmed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 08, 2026
Cross-Site Request Forgery in BEAR - Bulk Editor and Products Manager Professional for WooCommerce (all versions up to 1.1.5) allows unauthenticated attackers to delete WooCommerce taxonomy terms via a malicious link that tricks site administrators or shop managers into performing an action. The vulnerability stems from missing nonce validation on the woobe_delete_tax_term() function, enabling integrity compromise with low CVSS impact (4.3) but requiring user interaction.
RemediationAI
Site administrators should update the BEAR plugin to a version newer than 1.1.5, which includes nonce validation fixes per changesets 3457263 and 3465138 in the WordPress Plugin Directory repository. Patch details are available in the official Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/1e4e8960-b0c1-4dbb-ba97-e45b88fb06c0?source=cve). As a temporary workaround pending plugin update, site administrators should limit link-clicking from untrusted sources and educate users about CSRF risks; however, upgrading the plugin is the definitive remediation and should be prioritized.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a Cross-Site Request Forgery (CSRF) vulnerability classified under CWE-352, affecting the BEAR WordPress plugin for WooCommerce. The woobe_delete_tax_term() function fails to implement WordPress nonce validation mechanisms, which are cryptographic tokens that verify legitimate server-originated requests. Without nonce checks, an attacker can craft a forged HTTP request that, when executed by an authenticated site administrator or shop manager (who has the capability to delete taxonomy terms), will delete arbitrary WooCommerce categories, tags, or other taxonomy terms. The vulnerability exploits the trust that browsers place in authenticated sessions-when an admin visits a malicious website, the browser automatically includes their WordPress session cookies, allowing the attacker's JavaScript to perform unauthorized actions on the victim's WordPress installation.
Know when Bear Bulk Editor And Products Manager Professional For Woocommerce By Pluginus Net gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The BEAR - Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.5. This is due to missing nonce validation on the woobe_delete_tax_term() function. This makes it possible for unauthenticated attackers to delete WooCommerce taxonomy terms (categories, tags, etc.) via a forged request granted they can trick a site administrator or shop manager into performing an action such as clicking on a link.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
Exploit-DB