CVE-2023-4926

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulk_delete_products function. This makes it possible for unauthenticated attackers to delete products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Oct 20, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-492606.1An XSS attack can be performed by changing the MOTD banner and pointing the victim to the "terminal_tool.cgi" path. It can be used together CVE-2023-492617.5The "tokenKey" value used in user authorization is visible in the HTML source of the login page.CVE-2023-492629.8The authentication mechanism can be bypassed by overflowing the value of the Cookie "authentication" field, provided there is an active user CVE-2023-492695.4Hotel Management v1.0 is vulnerable to multiple authenticated Reflected Cross-Site Scripting vulnerabilities. The 'adults' parameter of the CVE-2023-492705.4Hotel Management v1.0 is vulnerable to multiple authenticated Reflected Cross-Site Scripting vulnerabilities. The 'check_in_date' parameter CVE-2023-492715.4Hotel Management v1.0 is vulnerable to multiple authenticated Reflected Cross-Site Scripting vulnerabilities. The 'check_out_date' parameter CVE-2023-492725.4Hotel Management v1.0 is vulnerable to multiple authenticated Reflected Cross-Site Scripting vulnerabilities. The 'children' parameter of th CVE-2023-492735.4Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, users wi CVE-2023-492745.3Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a user e CVE-2023-492756.5Wazuh is a free and open source platform used for threat prevention, detection, and response. A NULL pointer dereference was detected during CVE-2023-492766.1Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element in vulnerable to Attribute Inje CVE-2023-492776.1dpaste is an open source pastebin application written in Python using the Django framework. A security vulnerability has been identified in