Executive brief
BEAR is a WordPress plugin for managing WooCommerce products in bulk. The plugin fails to verify that a user owns a product before returning sensitive data about it, allowing restricted vendors to access other vendors' download URLs and private metadata. This could expose confidential product information and downloadable file locations.
Technical details
The BEAR plugin contains an insecure direct object reference (IDOR) vulnerability in multiple AJAX handlers (`woobe_get_downloads`, `woobe_meta_get_keys`, `woobe_get_gallery`, and related handlers) that retrieve product data by user-supplied product ID. While the main product listing endpoint enforces vendor ownership checks, these by-ID read handlers do not verify that the requesting user owns the product before returning sensitive data such as protected downloadable file URLs and private metadata. An authenticated user with the `manage_woocommerce` capability and assigned a vendor role can query any product ID to extract information that should be restricted. The vulnerability requires administrative setup to create custom vendor roles and multiple users, and is fixed in version 1.2.2.
Affected products
- Evgeny Vlasov BEAR – Bulk Editor and Products Manager Professional for WooCommerce before 1.2.2
Timeline
- 2026-09-10: disclosed
- 2026-09-12: patched: Fixed in version 1.2.2