Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
BEAR Plugin for WooCommerce allows attackers to delete product categories
CVE-2026-1673
Summary
The BEAR plugin for WordPress has a security flaw that allows attackers to delete product categories and other taxonomies without permission. This could happen if an administrator clicks on a malicious link. Update the plugin to the latest version to fix this issue.
Original title
The BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.5...
Original description
The BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.5. This is due to missing nonce validation on the woobe_delete_tax_term() function. This makes it possible for unauthenticated attackers to delete WooCommerce taxonomy terms (categories, tags, etc.) via a forged request granted they can trick a site administrator or shop manager into performing an action such as clicking on a link.
nvd CVSS3.1
4.3
Vulnerability type
CWE-352
Cross-Site Request Forgery (CSRF)
Published: 8 Apr 2026 · Updated: 9 Apr 2026 · First seen: 8 Apr 2026