BEAR Bulk Editor and Products Manager Professional for WooCommerce Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the BEAR - Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net, affecting all versions through 1.1.5. The vulnerability arises from inadequate nonce validation in the 'woobe_delete_tax_term()' function, allowing unauthenticated attackers to delete WooCommerce taxonomy terms, such as categories and tags. Exploitation requires tricking a site administrator or shop manager into clicking a link that initiates the deletion.

Impact

Exploitation of this vulnerability allows for Cross-Site Request Forgery, enabling the unauthorized deletion of WooCommerce taxonomy terms.

Reproduction

To reproduce this vulnerability, an attacker must send a forged request to the 'woobe_delete_tax_term()' function without a valid nonce. This can be done by tricking an administrator or shop manager into clicking a link that activates the request, such as through a phishing email or a malicious website.

Remediation

Users are advised to update the plugin to version 1.1.6 or later, where this vulnerability has been patched.