CVE-2023-4920

The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_save_options function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additionally, input sanitization and escaping is insufficient resulting in the possibility of malicious script injection.

• CWE-352
• CWE-352

• https://plugins.trac.wordpress.org/browser/woo-bulk-editor/trunk/index.php#L805Third Party Advisory
• https://plugins.trac.wordpress.org/changeset/2970262/woo-bulk-editor/trunk/index.php?contextall=1&old=2968292&old_path=%2Fwoo-bulk-editor%2Ftrunk%2Findex.phpThird Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/58d25eeb-b12c-4850-8308-eaa30982b5a8?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/woo-bulk-editor/trunk/index.php#L805Third Party Advisory
• https://plugins.trac.wordpress.org/changeset/2970262/woo-bulk-editor/trunk/index.php?contextall=1&old=2968292&old_path=%2Fwoo-bulk-editor%2Ftrunk%2Findex.phpThird Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/58d25eeb-b12c-4850-8308-eaa30982b5a8?source=cveThird Party Advisory

Published

Oct 20, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-49193Missing Authorization vulnerability in NerdPress Hubbub Lite…5.3
• CVE-2023-49194Insertion of Sensitive Information Into Debugging Code vulne…5.3
• CVE-2023-49195Improper Neutralization of Input During Web Page Generation …4.8
• CVE-2023-49196Missing Authorization vulnerability in Pagelayer Team PageLa…4.3
• CVE-2023-49197Cross-Site Request Forgery (CSRF) vulnerability in Apasionad…8.8
• CVE-2023-49198Mysql security vulnerability in Apache SeaTunnel. Attackers…7.5
• CVE-2023-49203Technitium 11.5.3 allows remote attackers to cause a denial …7.5
• CVE-2023-49208scheme/webauthn.c in Glewlwyd SSO server before 2.7.6 has a …9.8
• CVE-2023-4921A use-after-free vulnerability in the Linux kernel's net/sch…7.8
• CVE-2023-49210The openssl (aka node-openssl) NPM package through 2.0.0 was…9.8
• CVE-2023-49213The API endpoints in Ironman PowerShell Universal 3.0.0 thro…8.8
• CVE-2023-49214Usedesk before 1.7.57 allows chat template injection.9.8