Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

BEAR Plugin for WooCommerce allows attackers to delete product categories

CVE-2026-1673 · published 7 months ago
Summary

The BEAR plugin for WordPress has a security flaw that allows attackers to delete product categories and other taxonomies without permission. This could happen if an administrator clicks on a malicious link. Update the plugin to the latest version to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
realmag777 bear – bulk editor and products manager professional for woocommerce by pluginus.net <= 1.1.5
Original advisory text
BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery to Taxonomy Term Deletion
The BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.5. This is due to missing nonce validation on the woobe_delete_tax_term() function. This makes it possible for unauthenticated attackers to delete WooCommerce taxonomy terms (categories, tags, etc.) via a forged request granted they can trick a site administrator or shop manager into performing an action such as clicking on a link.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
4.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published8 Apr 2026
Updated26 Oct 2026
First seen8 Apr 2026
Sources
CVE-2026-1673 · NVD
CVE-2026-1673 · MITRE
Track software like this
Free during beta