CVE-2026-84024
UnknownSummary
The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce before saving its meta field configuration, allowing an attacker to overwrite that configuration by tricking a logged-in administrator into visiting a crafted page.
Risk Assessment
An attacker can alter the meta field configuration via a CSRF attack, potentially causing site malfunction or further abuse.
Recommendation
Update the BEAR plugin to version 1.2.2 or later. Review the meta field configuration for unauthorized changes.
Other vulnerabilities in BEAR WordPress plugin
See all- CVE-2026-84025Unknown
The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing users who are restricted to their own products to read other owners' product information, including protected downloadable file URLs and private product metadata.
- CVE-2026-84023Unknown
The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce or check user capabilities before updating taxonomy terms, allowing an attacker to modify arbitrary terms by tricking a logged-in privileged user into visiting a crafted page.
Original NVD description (English source)
The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce before saving its meta field configuration, allowing an attacker to overwrite that configuration by tricking a logged-in administrator into visiting a crafted page.