CVE-2026-1672

OVERVIEW CVE-2026-1672 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the BEAR (Bulk Editor and Products Manager Professional) plugin for WooCommerce by Pluginus.Net in all versions up to and including 1.1.5. The flaw exists in the woobe_redraw_table_row() function due to missing nonce validation, allowing attackers to modify WooCommerce product data including prices and descriptions. SEVERITY The vulnerability carries a CVSS 3.1 score of 6.5 (MEDIUM) with a network-based attack vector requiring low complexity and user interaction. The threat actor must trick a site administrator or shop manager into clicking a malicious link or performing a social engineering action. While no credentials are required for the attack initiation, the impact is confined to integrity compromise of product data, with no confidentiality or availability impact. The EPSS score of 0.00006 indicates minimal current prevalence in the wild. EXPLOITATION STATUS There is no evidence of active exploitation at this time. The vulnerability has not been added to CISA's Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat intelligence hot lists. No public exploit code has been widely distributed, and community attention appears limited. Organizations should prioritize patching when updates become available but are not facing imminent threat from this vulnerability in its current state.