CVE-2026-1672 describes a CSRF vulnerability in the BEAR – Bulk Editor and Products Manager Professional for WooCommerce plugin by Pluginus.Net. The issue is due to the absence of nonce validation in the woobe_redraw_table_row() function, which is used to update product data. Because of this, an attacker can craft a forged request that, when executed by an authenticated administrator or shop manager, results in unauthorized modification of WooCommerce product information. The vulnerability affects all versions up to and including 1.1.5. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

An attacker who successfully exploits this vulnerability can cause unauthorized modification of WooCommerce product data, including prices, descriptions, and other fields. This can lead to integrity issues in the online store's product catalog. The attack requires tricking an authorized user into performing an action, such as clicking a crafted link, but does not require the attacker to have any privileges themselves.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be cautious about clicking on untrusted links and consider restricting administrative access or implementing additional CSRF protections if possible.