CVE-2026-84025: BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Authenticated Product Download URL and Meta Disclosure via IDOR
Vulnerability summary
CVE-2026-84025 is a medium (CVSS 4.3) vulnerability in unknown bear. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14.7% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 1.2.2.
Timeline
- 12-09-2026PublishedVulnerability first disclosed.
- 12-09-2026Last modifiedVulnerability information updated.
Description
The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing users who are restricted to their own products to read other owners' product information, including protected downloadable file URLs and private product metadata.
CVSS metrics
3 scores · 3 sources · 1 version- CVE.orgCNA2.2LowCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:NDiffers
- NVDNIST2.2LowCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:NDiffers
EPSS trend
Probability
0.24%
Chance of exploitation in the next 30 days
Percentile
15%
Versus all other CVEs
30-day change
Increase +0.09 pp
From 0.15% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Unknown1 product
- bear< 1.2.2
Wordpress1 product
- woo-bulk-editor< 1.2.2
2 vendors · 2 products