WordPress Plugin Vulnerabilities

BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Meta Field Configuration Update via CSRF

Description

The plugin does not verify a CSRF nonce before saving its meta field configuration, allowing an attacker to overwrite that configuration by tricking a logged-in administrator into visiting a crafted page.

Proof of Concept

Affects Plugins

Plugin icon
woo-bulk-editor
Fixed in 1.2.2

References

CVE
CVE-2026-84024

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Ali Mousavi
Submitter
Ali Mousavi
Submitter twitter
Imalimousavi
Verified
Yes
WPVDB ID
8ea75cb0-e6f0-4ea4-a70f-f9c4e2e16681

Timeline

Publicly Published
2026-09-10 (about 2 days ago)
Added
2026-09-10 (about 1 day ago)
Last Updated
2026-09-10 (about 1 day ago)

Other

Published
Title
Published
2024-04-29
Title
SVS Pricing Tables <= 1.0.4 - Cross-Site Request Forgery to Pricing Table Deletion
Published
2026-05-19
Title
Word 2 Cash <= 0.9.2 - Cross-Site Request Forgeryto Stored Cross-Site Scripting via Settings Page
Published
2023-04-18
Title
BadgeOS <= 3.7.1.6 - CSRF
Published
2024-03-11
Title
LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… <= 4.4 - Cross-Site Request Forgery via publish_lp()
Published
2025-02-13
Title
Naver Syndication V2 <= 0.8.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting