Is CVE-2026-1673 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-1673 being exploited in the wild.

How severe is CVE-2026-1673?

Medium severity, with a CVSS score of 4.3, published 8 April 2026.

Is there a fix for CVE-2026-1673?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-1673 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-1673?

Check whether you run PluginUs.Net BEAR – Bulk Editor and Products Manager Professional for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-1673: Pluginus.Net BEAR Bulk Editor CSRF in woobe_delete_tax_term

CVE-2026-1673 · Severity: medium · CVSS 4.3 · Published 2026-04-08

The BEAR Bulk Editor plugin for WooCommerce is used by site owners to manage large product catalogs. A security flaw allows an attacker to trick a site administrator into clicking a link that silently deletes store categories, tags, or other organizational terms. This can disrupt the online store's navigation and product organization, potentially impacting sales and customer experience.

Technologies: PluginUs.Net BEAR – Bulk Editor and Products Manager Professional for WooCommerce. Vendors: PluginUs.Net.

Quick answers

Is CVE-2026-1673 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-1673 being exploited in the wild.
How severe is CVE-2026-1673?: Medium severity, with a CVSS score of 4.3, published 8 April 2026.
Which products and versions are affected?: PluginUs.Net BEAR – Bulk Editor and Products Manager Professional for WooCommerce <= 1.1.5.
Is there a fix for CVE-2026-1673?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-1673 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-1673?: Check whether you run PluginUs.Net BEAR – Bulk Editor and Products Manager Professional for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The BEAR – Bulk Editor and Products Manager Professional for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing nonce validation on the 'woobe_delete_tax_term' AJAX function. An unauthenticated attacker can exploit this by tricking a logged-in administrator or shop manager into visiting a malicious website or clicking a crafted link. The forged request triggers the vulnerable function, which accepts 'tax_key' and 'term_id' parameters without verifying the request's origin. This allows the attacker to delete product categories, tags, or other taxonomy terms, compromising the integrity of the WooCommerce store's catalog structure. The issue is fixed in version 1.1.6.

Affected products

realmag777 BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5

Timeline

2026-01-16: other: Vulnerability detected and reported to vendor
2026-04-07: disclosed: Public disclosure by Wordfence
2026-04-08: advisory: NVD published date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.