CVE-2026-1672

The BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.5. This is due to missing nonce validation on the woobe_redraw_table_row() function. This makes it possible for unauthenticated attackers to update WooCommerce product data including prices, descriptions, and other product fields via a forged request granted they can trick a site administrator or shop manager into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/woo-bulk-editor/trunk/index.php#L782
• https://plugins.trac.wordpress.org/changeset/3457263/
• https://plugins.trac.wordpress.org/changeset/3465138/
• https://research.cleantalk.org/cve-2026-1672/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/bc3b5faa-1a29-4fa7-9146-d782adce0b1f?source=cve

Published

Apr 8, 2026

Last Modified

Jul 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-16703IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a …7.8
• CVE-2026-16706IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a …7.5
• CVE-2026-16707IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.3…8.2
• CVE-2026-16708IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote …8.3
• CVE-2026-1671The Activity Log for WordPress plugin for WordPress is vulne…6.5
• CVE-2026-16713IBM Documentation Offline 1.0.0 through 1.4.1 IBM Documentat…5.3
• CVE-2026-16722IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authentica…8.8
• CVE-2026-16723A remote code execution (RCE) vulnerability exists in fastjs…9
• CVE-2026-16724IBM Virtualization Management Interface FW1110.00 through FW…4.5
• CVE-2026-16726Buffer overflow vulnerability in Panasonic Industry USB Driv…6.8
• CVE-2026-16727Concurrent Execution using Shared Resource with Improper Syn…7.3
• CVE-2026-16728undici's retry interceptor can deliver a response whose body…6.5