Is CVE-2026-45213 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45213 being exploited in the wild.

How severe is CVE-2026-45213?

High severity, with a CVSS score of 7.6, published 12 May 2026.

Which products and versions are affected?

RealMag777 BEAR - Bulk Editor and Products Manager for WooCommerce <= 1.1.7.1.

Is there a fix for CVE-2026-45213?

A patch was published on 2026-03-30: Patch released in version 1.1.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45213 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-45213?

Check whether you run RealMag777 BEAR - Bulk Editor and Products Manager for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45213: RealMag777 BEAR woo-bulk-editor SQL injection

Q: Is there a fix for CVE-2026-45213?

A patch was published on 2026-03-30: Patch released in version 1.1.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-45213 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-45213?

Check whether you run RealMag777 BEAR - Bulk Editor and Products Manager for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45213 · Severity: high · CVSS 7.6 · Published 2026-05-12

The BEAR Bulk Editor plugin for WooCommerce, which helps store owners manage large inventories, contains a security flaw that could allow an attacker to access sensitive database information. An attacker with high-level administrative or shop manager privileges could use this vulnerability to extract data they are not authorized to see. While the risk is mitigated by the requirement for high-level access, it could lead to the exposure of customer or business data.

Vendors: RealMag777.

Quick answers

Is CVE-2026-45213 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45213 being exploited in the wild.
How severe is CVE-2026-45213?: High severity, with a CVSS score of 7.6, published 12 May 2026.
Which products and versions are affected?: RealMag777 BEAR - Bulk Editor and Products Manager for WooCommerce <= 1.1.7.1.
Is there a fix for CVE-2026-45213?: A patch was published on 2026-03-30: Patch released in version 1.1.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45213 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-45213?: Check whether you run RealMag777 BEAR - Bulk Editor and Products Manager for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Blind SQL Injection vulnerability exists in the RealMag777 BEAR (woo-bulk-editor) plugin for WordPress due to improper neutralization of special elements in SQL commands. The flaw affects versions up to and including 1.1.7.1. An attacker with 'Shop Manager' or higher privileges can exploit this over the network without user interaction to perform unauthorized database queries. This can lead to the exfiltration of sensitive data from the WordPress database. The issue has been addressed in version 1.1.8.

Affected products

RealMag777 BEAR - Bulk Editor and Products Manager for WooCommerce <= 1.1.7.1

Timeline

2026-02-28: other: Vulnerability reported by researcher daroo
2026-03-30: patched: Patch released in version 1.1.8
2026-05-12: disclosed: CVE published to NVD

References

https://patchstack.com/database/Wordpress/Plugin/woo-bulk-editor/vulnerability/wordpress-bear-plugin-1-1-7-1-sql-injection-vulnerability?_s_id=cve

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.