Is CVE-2026-1672 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-1672 being exploited in the wild.

How severe is CVE-2026-1672?

Medium severity, with a CVSS score of 6.5, published 8 April 2026.

Is there a fix for CVE-2026-1672?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-1672 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-1672?

Check whether you run PluginUs.Net BEAR – Bulk Editor and Products Manager Professional for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-1672: Pluginus.Net BEAR Bulk Editor CSRF in woobe_redraw_table_row

CVE-2026-1672 · Severity: medium · CVSS 6.5 · Published 2026-04-08

The BEAR Bulk Editor plugin for WordPress, which is used to manage WooCommerce product catalogs, contains a security flaw that allows unauthorized changes to store data. By tricking a site administrator or shop manager into clicking a malicious link, an attacker can remotely modify product details such as prices and descriptions. This could lead to financial loss through unauthorized discounts or damage to a store's reputation through altered product information.

Technologies: PluginUs.Net BEAR – Bulk Editor and Products Manager Professional for WooCommerce. Vendors: PluginUs.Net.

Quick answers

Is CVE-2026-1672 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-1672 being exploited in the wild.
How severe is CVE-2026-1672?: Medium severity, with a CVSS score of 6.5, published 8 April 2026.
Which products and versions are affected?: PluginUs.Net BEAR – Bulk Editor and Products Manager Professional for WooCommerce <= 1.1.5.
Is there a fix for CVE-2026-1672?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-1672 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-1672?: Check whether you run PluginUs.Net BEAR – Bulk Editor and Products Manager Professional for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The BEAR Bulk Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing nonce validation on the 'woobe_redraw_table_row' AJAX function. This function processes product updates by accepting a 'product_id', 'field', and 'value' without verifying the request's origin. An unauthenticated attacker can exploit this by crafting a malicious request and tricking a logged-in administrator or shop manager into executing it via social engineering (e.g., clicking a link). Successful exploitation allows the attacker to update WooCommerce product fields, including sale prices and descriptions, inheriting the victim's administrative permissions. The issue is fixed in version 1.1.6.

Affected products

realmag777 BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5

Timeline

2026-01-15: other: Vulnerability discovered and reported to vendor
2026-04-07: disclosed: Public disclosure of vulnerability
2026-04-08: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.