CVE-2026-1673 is a CSRF vulnerability in the BEAR – Bulk Editor and Products Manager Professional for WooCommerce plugin by Pluginus.Net. The issue is caused by the absence of nonce validation in the woobe_delete_tax_term() function, which handles deletion of WooCommerce taxonomy terms. An attacker can exploit this by crafting a forged request that, when executed by an authenticated site administrator or shop manager, results in unauthorized deletion of taxonomy terms. This vulnerability affects all versions up to and including 1.1.5. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, but requiring user interaction. There is no vendor advisory or patch available at this time.

Successful exploitation allows an attacker to delete WooCommerce taxonomy terms such as product categories or tags without authentication, by tricking an authorized user into performing an action. This can lead to disruption of product organization and potential business impact due to loss of taxonomy data. There is no direct confidentiality or availability impact reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution when interacting with untrusted links or requests that could trigger taxonomy term deletions. Monitoring for suspicious activity related to taxonomy term changes is advisable. Avoid clicking on unknown or suspicious links while logged in with administrative or shop manager privileges.