Quick answers
- Is CVE-2026-84025 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-84025 being exploited in the wild.
- How severe is CVE-2026-84025?
- Low severity, with a CVSS score of 2.2, published 12 September 2026.
- Which products and versions are affected?
- Evgeny Vlasov BEAR – Bulk Editor and Products Manager Professional for WooCommerce before 1.2.2.
- Is there a fix for CVE-2026-84025?
- A patch was published on 2026-09-12: Fixed in version 1.2.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-84025 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-84025?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The BEAR plugin contains an insecure direct object reference (IDOR) vulnerability in multiple AJAX handlers (`woobe_get_downloads`, `woobe_meta_get_keys`, `woobe_get_gallery`, and related handlers) that retrieve product data by user-supplied product ID. While the main product listing endpoint enforces vendor ownership checks, these by-ID read handlers do not verify that the requesting user owns the product before returning sensitive data such as protected downloadable file URLs and private metadata. An authenticated user with the `manage_woocommerce` capability and assigned a vendor role can query any product ID to extract information that should be restricted. The vulnerability requires administrative setup to create custom vendor roles and multiple users, and is fixed in version 1.2.2.
Affected products
- Evgeny Vlasov BEAR – Bulk Editor and Products Manager Professional for WooCommerce before 1.2.2
Timeline
- 2026-09-10: disclosed
- 2026-09-12: patched: Fixed in version 1.2.2