CVE-2026-1672: CSRF in BEAR Bulk Editor for WooCommerce Allowing Unauth Product Data Modification

Vulnerability Overview CVE ID: CVE-2026-1672 Vulnerability Type: CSRF (Cross-Site Request Forgery) Affected Plugins: BEAR Bulk Editor and Products Manager Professional for WooCommerce Vulnerability Description: This vulnerability allows unauthenticated attackers to modify WooCommerce product data, including fields such as price and description, by forging requests. Scope of Impact Affected Versions: BEAR Bulk Editor <= 1.1.5, Fixed Version: 1.1.6 Installs: 40,000+ Disclosure Date: April 7, 2026 Last Updated: April 8, 2026 Researcher: Dmitrii Ignatyev Remediation Recommended Measures: - Update BEAR Bulk Editor to version 1.1.6 or later. - Administrators and store managers should avoid clicking untrusted links while logged into WordPress. - Developers should add dedicated nonce verification for AJAX operations and verify whether the current user has permission to edit the requested product. - Restrict field names to a strict whitelist and validate each value before saving. POC Code Timeline January 15, 2026: Plugin testing and vulnerability detection completed. January 15, 2026: Vulnerability report submitted, including POC, description, and remediation suggestions. April 7, 2026: CVE-2026-1672 publicly disclosed. Discovery and Exploitation Vulnerability Discovery: The AJAX operation was found to lack WordPress nonce validation during testing. Exploitation Method: Attackers can forge requests to modify product prices and other fields. Security Recommendations Strengthen Security Measures: - Implement CSRF protection mechanisms. - Regularly update plugins and the WordPress core. - Monitor and audit website activity to promptly detect abnormal behavior. Related Links CVE Record: https://www.cve.org/CVERecord?id=CVE-2026-1672 Wordfence Threat Intelligence: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/woob-bulk-editor/bear-bulk-editor-and-products-manager-professional-for-woocommerce-by-pluginsnut-115-cross-site-request-forgery-to-product-data-modification Additional Information Plugin Logo: BEAR Bulk Editor & Products Manager Security Certification: CleanTalk Plugin Security Certification (PSC) - Not Secure Author Information Author: Dmitrii I Bio: Penetration tester with 5 years of experience in WordPress and web application security, holding OSWE, OSEP, OSCP, and OSWP certifications. Related Articles CVE-2024-2220: Button contact VR - Stored XSS to JS backdoor creation - POC Plugin Security Certification (PSC-2025-64593): Meta pixel for WordPress - Version 4.1.5: Use Logs with Enhanced Security Plugin Security Certification (PSC-2024-64536): "WP Super Cache" - Version 3.0.3: Use Cache with Enhanced Security Footer Information CleanTalk: Provides anti-spam and plugin security certification services. Contact: Create a support ticket, Contact Us, Telegram, X. --- The above is a summary of the key information regarding the vulnerability from the webpage screenshot.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-1672: CSRF in BEAR Bulk Editor for WooCommerce Allowing Unauth Product Data Modification