CVE-2026-84025
UnknownSummary
The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing users who are restricted to their own products to read other owners' product information, including protected downloadable file URLs and private product metadata.
Risk Assessment
A low-privileged user can access protected files and private metadata belonging to other owners, compromising data confidentiality.
Recommendation
Update the BEAR plugin to version 1.2.2 or later. Check whether protected files were downloaded by unauthorized users.
Other vulnerabilities in BEAR WordPress plugin
See all- CVE-2026-84024Unknown
The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce before saving its meta field configuration, allowing an attacker to overwrite that configuration by tricking a logged-in administrator into visiting a crafted page.
- CVE-2026-84023Unknown
The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce or check user capabilities before updating taxonomy terms, allowing an attacker to modify arbitrary terms by tricking a logged-in privileged user into visiting a crafted page.
Original NVD description (English source)
The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing users who are restricted to their own products to read other owners' product information, including protected downloadable file URLs and private product metadata.