This vulnerability is a Cross-Site Request Forgery (CWE-352) in the realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional and BEAR – Bulk Editor and Products Manager Professional for WooCommerce plugins. It affects versions through 1.0.8.1 for WOLF and 1.1.4.1 for BEAR. The vulnerability enables attackers to trick authenticated users into submitting unauthorized requests, potentially leading to unintended modifications in bulk post or product management. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, no privileges required, but requiring user interaction, and impacts integrity with no confidentiality or availability impact. No patch or official remediation is currently documented.

Successful exploitation could allow an attacker to cause authenticated users to perform unintended actions within the affected plugins, potentially leading to unauthorized modifications of posts or products. The impact is limited to integrity with no direct confidentiality or availability consequences. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting exposure by restricting access to the affected plugins and ensuring users are cautious about interacting with untrusted content that could trigger CSRF attacks. Monitor vendor channels for updates and apply patches promptly once available.