EUVD-2026-93066
GHSA-56vc-pjw6-c4x7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running BEAR <= 1.2.2
-
ExploitSend crafted request to unprotected endpoint
-
ExecutionBypass missing authorization check
-
ImpactPerform restricted action / access data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the BEAR plugin (realmag777) version 1.2.2 or earlier to be installed and active on a WordPress site; exploitation is unauthenticated (PR:N) and network-reachable with no user interaction, so no login, token, or victim action is needed. The description does not name the exact vulnerable endpoint, parameter, or feature beyond 'Broken Access Control' (Missing Authorization, CWE-862), so the precise request needed is not confirmed from available data. The primary limiting factor is deployment: only sites running this specific plugin version are exposed, and the technical impact is partial (LOW) rather than full compromise. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, score 7.3 HIGH) describes a network-reachable, low-complexity, unauthenticated flaw with low partial impact across confidentiality, integrity, and availability, consistent with CWE-862 (Missing Authorization) and the description's 'Unauthenticated Broken Access Control.' These signals align internally and point to an easily reachable weakness. However, the risk-prioritizing signals are absent: no EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. No SSVC decision data was supplied. The net picture is a genuinely low-barrier bug (unauthenticated, network, low complexity) but with only LOW/partial technical impact and no exploitation-probability data - making it a moderate-priority patch for sites running the plugin rather than an emergency. One data caveat: the single reference URL's plugin slug is 'woo-bulk-editor' while the CVE product name and CPE are 'bear' (realmag777) - verify the exact affected plugin with the vendor/Patchstack before acting. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted HTTP request directly to a BEAR plugin endpoint that fails to enforce an authorization check, allowing an action normally restricted to privileged users. Given AV:N/AC:L/PR:N/UI:N, no login, user interaction, or special timing is required against an affected WordPress site. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Unauthenticated broken access control in the BEAR bulk-editor plugin for WordPress (vendor realmag777, plugin slug woo-bulk-editor) affects version 1.2.2 and earlier, letting network-reachable attackers invoke functionality that should require authorization without any login, token, or victim interaction. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, 7.3 HIGH) rates the technical impact as partial across confidentiality, integrity, and availability rather than full site compromise, and exploitation is gated primarily by deployment - only sites with this specific plugin version installed and active are exposed. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the Patchstack report does not disclose the precise vulnerable endpoint or parameter.
RemediationAI
No vendor-released patch identified at time of analysis: the provided intelligence contains no fixed version number, GitHub commit, or PR, and the only reference is the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/woo-bulk-editor/vulnerability/wordpress-bear-plugin-1-2-2-broken-access-control-vulnerability?_s_id=cve), so administrators should check that entry and the plugin's WordPress.org page for an updated release before assuming a fix exists. If the plugin is not essential, the most reliable mitigation is to deactivate and remove BEAR entirely, which eliminates the unauthenticated attack surface at the cost of losing its bulk-editing functionality. If it must remain active, restrict access to the plugin's AJAX and REST entry points - for example, block unauthenticated POSTs to /wp-admin/admin-ajax.php carrying BEAR-specific action parameters and to the plugin's REST namespace - and consider fronting admin-ajax.php with IP allowlisting or HTTP authentication; the trade-off is that admin-ajax.php is shared by many plugins, so blanket blocking will break unrelated functionality and broad action-based WAF signatures risk false positives. Virtual patching or a WAF rule that rejects unauthenticated requests to the vulnerable action is a reasonable interim control, but because the exact endpoint and parameter are not disclosed in the available data, such rules cannot be precisely scoped and must be combined with monitoring for unexpected plugin-related requests. Given the unauthenticated, low-complexity nature of the flaw, treat any site running BEAR 1.2.2 or earlier as potentially reachable and prioritize upgrading or deactivating the plugin over compensating controls.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a third-party WordPress plugin - BEAR, distributed under the slug woo-bulk-editor by vendor realmag777 and tracked by CPE cpe:2.3:a:realmag777:bear:*:*:*:*:*:*:*:* - which provides bulk editing capabilities (typically for WooCommerce product data) inside the WordPress administrative surface. The root cause class is CWE-862 (Missing Authorization): WordPress plugins commonly expose actions through admin-ajax.php hooks or REST API routes, and secure implementations must pair each action with a capability check (current_user_can) and, for state-changing operations, a nonce check; when those checks are absent or applied only on the client side, the endpoint is reachable by unauthenticated HTTP requests. That aligns with the assessed vector, where PR:N and UI:N indicate no account and no user interaction are required, AV:N and AC:L indicate a directly reachable, low-complexity request path, and the uniform LOW ratings on C/I/A indicate the exposed function is limited in scope rather than granting full administrative control (scope remains Unchanged). The description and available intelligence do not name the specific hook, action name, parameter, or feature involved, so the exact request required is not confirmed from the provided data.
Know when Bear gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Unauthenticated missing-authorization flaw reachable over the network with no user interaction (PR:N/UI:N/AV:N/AC:L); impact is partial across C/I/A, matching broken access control to a restricted action.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions.
Executive ViewAI
WordPress sites running the BEAR bulk-editor plugin (woo-bulk-editor) version 1.2.2 and earlier are exposed to an unauthenticated access-control flaw that could let remote attackers perform privileged bulk-editing actions without logging in. Because no vendor-released patch is identified at time of analysis, affected organizations face potential unauthorized catalog or content changes and service disruption until the plugin is removed or access is mitigated. No public exploit identified at time of analysis, but the network-reachable exposure and partial confidentiality, integrity, and availability impact justify immediate inventory and containment.
Deactivate or remove the BEAR bulk-editor plugin (woo-bulk-editor) on affected WordPress sites; if it must remain active, restrict unauthenticated access to plugin endpoints via WAF or virtual patching, enforce least privilege, and monitor logs for unauthorized bulk-edit activity. Apply vendor patch when released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Blind SQL injection in BEAR woo-bulk-editor plugin for WordPress up to version 1.1.7.1 allows high-privilege authenticat
Reflected/stored cross-site scripting in the WordPress plugin BEAR (realmag777's WooCommerce Bulk Editor and Products Ma
Cross-site request forgery (CSRF) in PluginUs.Net BEAR plugin versions up to 1.1.5 allows unauthenticated remote attacke
Exploit-DB