Exploitation Research Plan: CVE-2026-1673 (BEAR – Bulk Editor CSRF)

1. Vulnerability Summary

The BEAR – Bulk Editor and Products Manager Professional for WooCommerce plugin (versions <= 1.1.5) is vulnerable to Cross-Site Request Forgery (CSRF). The vulnerability exists in the woobe_delete_tax_term() function, which is responsible for deleting WooCommerce taxonomy terms. This function fails to implement a nonce check (e.g., check_ajax_referer or wp_verify_nonce), allowing an attacker to perform unauthorized deletions by tricking an authenticated administrator or shop manager into clicking a malicious link or visiting a forged page.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: woobe_delete_tax_term (inferred from function name)
• HTTP Method: POST
• Vulnerable Parameter: term_id (the ID of the taxonomy term) and taxonomy (the slug of the taxonomy, e.g., product_cat)
• Authentication Level: Requires an active session of a user with manage_options or manage_woocommerce capabilities (Administrator or Shop Manager).
• Preconditions: The attacker must know (or guess) the ID of the taxonomy term they wish to delete.

3. Code Flow (Inferred)

1. Entry Point: The plugin registers an AJAX action for authenticated users:
   add_action('wp_ajax_woobe_delete_tax_term', 'woobe_delete_tax_term'); (inferred).
2. Vulnerable Function: The woobe_delete_tax_term() function is called.
3. Missing Security Check: The function lacks a call to check_ajax_referer() or wp_verify_nonce(). It may still perform a capability check like current_user_can('manage_options'), but this does not protect against CSRF.
4. Sink: The function retrieves term_id and taxonomy from the $_POST superglobal and passes them to the WordPress core function wp_delete_term($term_id, $taxonomy).

4. Nonce Acquisition Strategy

According to the vulnerability description, this vulnerability is characterized by missing nonce validation.

• Strategy: No nonce is required for exploitation. The exploitation strategy will focus on demonstrating that a request made by an authenticated administrator succeeds even when no nonce parameter (e.g., security, _wpnonce, or nonce) is provided.

5. Exploitation Strategy

The goal is to demonstrate that an authenticated user can be forced to delete a taxonomy term without their consent.

Step-by-step Plan:

1. Setup: Create a dummy product category to serve as the deletion target.
2. Identify Target: Determine the term_id of the created category.
3. Execution: Use the http_request tool to send a POST request to admin-ajax.php mimicking a CSRF attack (performing the action as the admin without a nonce).
4. Verification: Confirm the term is gone using WP-CLI.

Request Details:

• URL: {{base_url}}/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=woobe_delete_tax_term&term_id=[TARGET_TERM_ID]&taxonomy=product_cat
  

6. Test Data Setup

Before executing the exploit, the following environment state must be established:

1. Install Plugin: Ensure woo-bulk-editor version 1.1.5 is installed and active.
2. Create Victim Term:

   wp term create product_cat "CSRF Target Category" --description="This should be deleted"
   

3. Capture ID: Get the ID of the newly created term:

   wp term list product_cat --field=term_id --name="CSRF Target Category"
   

7. Expected Results

• HTTP Response: The server should return a successful response (likely a JSON success message or 1 if the handler exits simply).
• System Impact: The taxonomy term with the specified term_id will be permanently removed from the WooCommerce store.

8. Verification Steps

After the http_request is sent, verify the deletion via WP-CLI:

# Attempt to get the term by name
wp term get product_cat "CSRF Target Category"

• Vulnerable Result: WP-CLI returns an error: Error: Term does not exist.
• Fixed/Safe Result: WP-CLI returns the term details, indicating the deletion request was rejected.

9. Alternative Approaches

If woobe_delete_tax_term is not the exact action name, audit the plugin files for any instances of add_action('wp_ajax_... to find the correct registration:

grep -rn "wp_ajax_" wp-content/plugins/woo-bulk-editor/

If the plugin uses a specific parameter for the term ID other than term_id (e.g., id or tid), this can be identified by inspecting the function body in the plugin's source code (likely in classes/models/settings.php or similar).