CVE-2026-1673 is a CSRF vulnerability in the BEAR – Bulk Editor and Products Manager Professional for WooCommerce plugin by Pluginus.Net affecting all versions up to 1.1.5. The issue is due to missing nonce validation on the woobe_delete_tax_term() function, which handles deletion of WooCommerce taxonomy terms like categories and tags. An attacker can exploit this by tricking a site administrator or shop manager into executing a forged request, leading to unauthorized deletion of taxonomy terms. The vulnerability does not require privileges or authentication but does require user interaction (UI:R).

Successful exploitation can result in unauthorized deletion of WooCommerce taxonomy terms such as categories and tags, which may disrupt the organization and management of products on affected WooCommerce stores. The impact is limited to integrity loss (I:L) with no direct confidentiality or availability impact reported. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators and shop managers should be cautious about clicking on untrusted links or performing actions initiated from unverified sources. Monitoring for updates from the plugin vendor or Pluginus.Net is recommended to apply any forthcoming patches promptly.