CVE-2023-4926: BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Deletion
The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobebulkdeleteproducts function. This makes it possible for unauthenticated attackers to delete products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-4926?
CVE-2023-4926 is a vulnerability in the BEAR for WordPress plugin up to and including version 1.1.3.3, which allows unauthenticated attackers to delete products via a forged request.
How severe is CVE-2023-4926?
CVE-2023-4926 has a severity rating of medium, with a CVSS score of 5.4.
How does CVE-2023-4926 affect the BEAR for WordPress plugin?
CVE-2023-4926 affects versions up to and including 1.1.3.3 of the BEAR for WordPress plugin by allowing unauthenticated attackers to delete products by sending forged requests.
How can I fix CVE-2023-4926?
To fix CVE-2023-4926, users should update the BEAR for WordPress plugin to a version higher than 1.1.3.3 that includes the necessary nonce validation.
Where can I find more information about CVE-2023-4926?
More information about CVE-2023-4926 can be found in the references provided: [Reference 1](https://plugins.trac.wordpress.org/browser/woo-bulk-editor/trunk/ext/bulk/bulk.php#L159), [Reference 2](https://plugins.trac.wordpress.org/changeset/2970262/woo-bulk-editor/trunk/ext/bulk/bulk.php?contextall=1&old=2844667&old_path=%2Fwoo-bulk-editor%2Ftrunk%2Fext%2Fbulk%2Fbulk.php), [Reference 3](https://www.wordfence.com/threat-intel/vulnerabilities/id/ab633506-63a1-4be1-b402-c7f0bcc4ea7a?source=cve)