CVE-2026-84023
UnknownSummary
The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce or check user capabilities before updating taxonomy terms, allowing an attacker to modify arbitrary terms by tricking a logged-in privileged user into visiting a crafted page.
Risk Assessment
An attacker can alter the taxonomy structure of the WordPress site, potentially causing site malfunction or unauthorized content modification without the administrator's knowledge.
Recommendation
Update the BEAR plugin to version 1.2.2 or later.
Other vulnerabilities in BEAR WordPress plugin
See all- CVE-2026-84025Unknown
The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing users who are restricted to their own products to read other owners' product information, including protected downloadable file URLs and private product metadata.
- CVE-2026-84024Unknown
The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce before saving its meta field configuration, allowing an attacker to overwrite that configuration by tricking a logged-in administrator into visiting a crafted page.
Original NVD description (English source)
The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce or check user capabilities before updating taxonomy terms, allowing an attacker to modify arbitrary terms by tricking a logged-in privileged user into visiting a crafted page.