CVE-2026-84025

Published: Sep 12, 2026Modified: Sep 14, 2026Deferred

2.2

Vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

Exploitability: 0.7 / Impact: 1.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing users who are restricted to their own products to read other owners' product information, including protected downloadable file URLs and private product metadata.

Related CWEs

CWE-639

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (1)

https://wpscan.com/vulnerability/468a9f1a-1a16-410f-97a0-8a87a974df21/

Source: contact@wpscan.com

Timeline

No history available yet.