CVE-2026-95526: WordPress BEAR plugin <= 1.2.2 - Broken Access Control vulnerability
Published Oct 6, 2026
·Updated
Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions.
Affected Software
1 affected component
WordPress BEAR Plugin<=1.2.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress BEAR Pluginto a version that resolves this vulnerability.Fixed in 1.2.3
Event History
Oct 6, 2026
CVE Published
via MITRE·08:35 AM
Data Sourced
via MITRE·08:35 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·09:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
The vulnerability is described as unauthenticated, so an attacker does not need a WordPress account or prior privileges to exploit it.
2
Which installations are affected?
BEAR plugin versions 1.2.2 and earlier are identified as affected. The provided data does not state whether a particular plugin configuration is required.
3
What is the potential impact?
The severity vector indicates low potential impact to confidentiality, integrity, and availability. The attack is network-accessible, requires low complexity, and does not require user interaction.