MEDIUM
CVE-2026-84023
CVSS
6.5
Description
The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce or check user capabilities before updating taxonomy terms, allowing an attacker to modify arbitrary terms by tricking a logged-in privileged user into visiting a crafted page.
Weakness (CWE)
CWE-352
Cross-Site Request Forgery (CSRF)
EPSS Score
0.11%
Probability of exploitation in next 30 days
1.6th percentile
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.