CVE-2026-84025CWE-639

CVE-2026-84025

Low · published September 12, 2026

CVSS v3.1
2.2
EPSS
0%
Percentile
14.7
In the wild
Unconfirmed
What it is

The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing users who are restricted to their own products to read other owners' product information, including protected downloadable file URLs and private product metadata.

The record
Technical detail
CVSS v3.1
2.2 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00244 · 14.7th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-12T10:16Z
References (1)
https://wpscan.com/vulnerability/468a9f1a-1a16-410f-97a0-8a87a974df21/ · [email protected]
EPSS history
Timeline
  • 13 SEP 03:23Z
    EPSS moved — → 0%
    epss
  • 12 SEP 06:00Z
    BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Authenticated Product Download URL and Meta Disclosure via IDOR
    cvelistv5