CVE-2026-1673 describes a CSRF vulnerability in the BEAR – Bulk Editor and Products Manager Professional for WooCommerce plugin by Pluginus.Net. The issue is due to the absence of nonce validation on the woobe_delete_tax_term() function, which handles deletion of WooCommerce taxonomy terms. This lack of protection enables an attacker to craft a malicious request that, when executed by an authenticated user with sufficient privileges (administrator or shop manager), results in unauthorized deletion of taxonomy terms. The vulnerability affects all plugin versions up to and including 1.1.5. No official patch or remediation guidance is currently documented.

An attacker can cause unauthorized deletion of WooCommerce taxonomy terms (such as categories and tags) by tricking an authenticated administrator or shop manager into executing a malicious request. This can disrupt the organization and categorization of products in the WooCommerce store, potentially impacting store management and user experience. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators and shop managers should avoid interacting with untrusted links or requests that could trigger deletion actions. Monitoring for suspicious activity related to taxonomy term deletions is advisable.