Executive brief
BEAR is a WordPress plugin for bulk editing and managing WooCommerce products. The plugin contains a cross-site request forgery vulnerability that allows an attacker to trick a logged-in administrator or shop manager into modifying product categories without their knowledge or consent. An attacker can change category names, slugs, and other settings by crafting a malicious webpage and luring a privileged user to visit it.
Technical details
The vulnerability is a CSRF (CWE-352) in the woobe_update_tax_term AJAX action. The plugin fails to verify a nonce token before processing taxonomy term updates, and does not properly check user capabilities. An attacker can craft an HTML form that submits a GET request to wp-admin/admin-ajax.php with parameters to modify arbitrary product category terms. The attack requires a logged-in user with administrative or shop manager privileges to visit the attacker's page; WordPress auth cookies default to SameSite=Lax, allowing the victim's session to be used for the cross-origin request. The attacker can modify term names, slugs, parent categories, and other attributes. The vulnerability was fixed in version 1.2.2.
Affected products
- Automattic BEAR before 1.2.2
Timeline
- 2026-09-10: disclosed
- 2026-09-12: patched: Fixed in version 1.2.2