CVE-2026-84024: BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Meta Field Configuration Update via CSRF
The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce before saving its meta field configuration, allowing an attacker to overwrite that configuration by tricking a logged-in administrator into visiting a crafted page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BEAR - Bulk Editor and Products Manager Professional for WooCommerceto a version that resolves this vulnerability.Fixed in 1.2.2 - Compensating control
Ensure the WordPress administrator is protected from CSRF by restricting access to the admin endpoints and requiring CSRF nonce validation when saving meta field configuration (as described for the vulnerable behavior) until the plugin is upgraded.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using a BEAR plugin version earlier than 1.2.2 are exposed when a WordPress administrator is logged in and can be tricked into visiting an attacker-controlled crafted page.
What can an attacker change through this vulnerability?
An attacker can overwrite the plugin's meta field configuration. Exploitation depends on inducing a logged-in administrator to make the crafted request.
Does the attacker need administrator credentials?
The attacker does not need to authenticate as an administrator, but a logged-in administrator must visit the crafted page because the affected configuration update does not verify a CSRF nonce.