CVE-2023-4923: BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Deletion
The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobebulkoperationsdelete function. This makes it possible for unauthenticated attackers to delete products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-4923?
CVE-2023-4923 is a vulnerability in the BEAR for WordPress plugin that allows unauthenticated attackers to delete products via a forged request.
How severe is CVE-2023-4923?
CVE-2023-4923 has a severity score of 5.4, which is considered medium.
How does CVE-2023-4923 work?
CVE-2023-4923 occurs due to missing or incorrect nonce validation in the woobe_bulkoperations_delete function, allowing unauthenticated attackers to perform CSRF attacks and delete products.
Which software versions are affected by CVE-2023-4923?
Versions up to and including 1.1.3.3 of the Bear - Woocommerce Bulk Editor And Products Manager Professional plugin for WordPress are affected by CVE-2023-4923.
Are there any references for CVE-2023-4923?
Yes, you can find references for CVE-2023-4923 [here](https://plugins.trac.wordpress.org/browser/woo-bulk-editor/trunk/ext/bulkoperations/bulkoperations.php#L344) and [here](https://plugins.trac.wordpress.org/changeset/2970262/woo-bulk-editor/trunk/ext/bulkoperations/bulkoperations.php?contextall=1&old=2844667&old_path=%2Fwoo-bulk-editor%2Ftrunk%2Fext%2Fbulkoperations%2Fbulkoperations.php).