CVE-2026-1673 affects BEAR Bulk Editor and Products Manager Professional for WooCommerce and is a cross site request forgery vulnerability that can delete WooCommerce taxonomy terms in versions through 1.1.5. The woobe_delete_tax_term AJAX action accepts tax_key and term_id without validating a WordPress nonce. An unauthenticated attacker can prepare a forged request that deletes product categories, tags, or other terms when a logged in administrator or shop manager visits a malicious page.
| CVE | CVE-2026-1673 |
| Plugin Version | BEAR Bulk Editor <= 1.1.5, fixed in 1.1.6 |
| All Time | 779 483 |
| Active installations | 40 000+ |
| Publicly Published | April 7, 2026 |
| Last Updated | April 8, 2026 |
| Researcher | Dmitrii Ignatyev |
| PoC | Yes |
| Exploit | No |
| Reference | https://www.cve.org/CVERecord?id=CVE-2026-1673 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/woo-bulk-editor/bear-bulk-editor-and-products-manager-professional-for-woocommerce-by-pluginusnet-115-cross-site-request-forgery-to-taxonomy-term-deletion |
| Plugin Security Certification by CleanTalk |  |
| Logo of the plugin |  |
PSC by CleantalkJoin the community of developers who prioritize security. Highlight your plugin in the WordPress catalog.
Timeline
| January 16, 2026 | Plugin testing and vulnerability detection in BEAR Bulk Editor were completed. |
| January 16, 2026 | The vulnerability was reported with PoC, description, and recommendations for remediation. |
| April 7, 2026 | CVE-2026-1673 was publicly published by Wordfence. |
Discovery of the Vulnerability
During testing, the vulnerable surface was the woobe_delete_tax_term AJAX action at wp-admin/admin-ajax.php. The handler accepts a taxonomy key in tax_key and a term identifier in term_id, then deletes the selected WooCommerce taxonomy term.
In affected versions, the action did not validate a WordPress nonce before processing the deletion. A malicious page can therefore submit the request through the browser of a logged in administrator or shop manager. The request inherits the victim’s authenticated session and can remove a product category, tag, or another term used to organize the store catalog.
Understanding of CSRF attacks
Cross site request forgery abuses the trust a website places in an authenticated browser. An attacker does not need the victim’s password or session cookie. Instead, the attacker prepares a request to the target site and persuades a logged in user to open a page that submits it.
WordPress nonces are designed to stop this request flow by proving that an administrative action originated from an expected screen. Capability checks provide a second boundary by confirming that the current user may manage the selected taxonomy. Term deletion actions should require both controls and validate the taxonomy and term before making a change.
Exploiting the CSRF Vulnerability
An unauthenticated attacker can host the following page and persuade a logged in administrator or shop manager to open it. The proof of concept requests deletion of product category term 69 through the affected AJAX action.
POC:
POC: <html> <form action="http://127.0.0.1/wordpress/wp-admin/admin-ajax.php" method="POST"> <input type="hidden" name="action" value="woobe_delete_tax_term"> <input type="hidden" name="tax_key" value="product_cat"> <input type="hidden" name="term_id" value="69"> </form> <script>document.forms[0].submit()</script> </html>____
The request demonstrates a direct integrity impact on WooCommerce catalog structure. Testing should use a disposable term in a local environment because the selected category is deleted when the victim’s session has the required access.
Recommendations for Improved Security
Site owners should update BEAR Bulk Editor to version 1.1.6 or a newer release. Administrators and shop managers should avoid opening untrusted links while signed in to WordPress, especially when an immediate update is not possible.
Developers should require a dedicated nonce for the AJAX action and validate it with check_ajax_referer. The handler should also verify that the current user has the required taxonomy management capability, allow only expected taxonomy keys, confirm the term exists, and handle deletion errors before returning a success response.
By addressing CSRF issues like CVE-2026-1673, WooCommerce site owners can protect taxonomy data from forged administrative requests and reduce the risk of unauthorized catalog changes. Stay vigilant, stay secure.
#WordPressSecurity #CSRF #WooCommerceSecurity #WebsiteSafety #StayProtected #MediumVulnerability
Use CleanTalk solutions to improve the security of your website
