The BEAR – Bulk Editor and Products Manager Professional for WooCommerce plugin suffers from a CSRF vulnerability caused by missing nonce validation on the woobe_redraw_table_row() function. This flaw enables attackers to craft malicious requests that, when executed by an authenticated user with administrative or shop manager privileges, can modify WooCommerce product data including prices and descriptions. The vulnerability affects all versions up to 1.1.5. The CVSS 3.1 vector indicates the attack requires no privileges but does require user interaction (UI:R), and impacts integrity (I:H) without affecting confidentiality or availability.

Successful exploitation can lead to unauthorized modification of WooCommerce product data such as prices and descriptions, potentially causing data integrity issues and business impact. There is no impact on confidentiality or availability reported. The attack requires tricking a privileged user into performing an action, such as clicking a malicious link.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators and shop managers should be cautious about clicking on untrusted links or performing actions initiated from unverified sources. Monitoring for updates from Pluginus.Net or the plugin vendor is recommended to apply any forthcoming official fixes.