BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)

BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) has 24 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 24 are fixed as of September 2026. Their average CVSS score is 5.1, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high. 2023 was the busiest year with 13 disclosures.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 14 of the records (58%). Other recurring categories include Missing Authorization, Cross-Site Scripting.

Every one of the 24 issues recorded for BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) has a vendor fix available, so running the current release closes all known holes.

10 independent researchers contributed these findings, most of them (12) reported by Marco Wotschka. BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) is installed on roughly 40,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

01234567891007.05.2018Today22.05.20236.5BEAR <= 1.1.3.1 - Cross-Site Request Forgery via Multiple Functions CVSS 6.5 · 22.05.202325.09.20234.3BEAR <= 1.1.3.3 - Missing Authorization to Product Manipulation CVSS 4.3 · 25.09.20234.3BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Profile Deletion CVSS 4.3 · 25.09.20234.3BEAR <= 1.1.3.3 - Missing Authorization to Product Manipulation CVSS 4.3 · 25.09.20235.4BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Deletion CVSS 5.4 · 25.09.20235.4BEAR <= 1.1.3.3 - Missing Authorization to Product Deletion CVSS 5.4 · 25.09.20235.4BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Deletion CVSS 5.4 · 25.09.20234.3BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Profile Creation CVSS 4.3 · 25.09.20234.3BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVSS 4.3 · 25.09.20234.3BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Manipulation CVSS 4.3 · 25.09.20234.3BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Manipulation CVSS 4.3 · 25.09.20234.3BEAR <= 1.1.3.3 - Missing Authorization to Product Manipulation CVSS 4.3 · 25.09.20234.3BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Manipulation CVSS 4.3 · 25.09.202302.02.20245.5BEAR <= 1.1.4 - Authenticated (Shop manager+) Stored Cross-Site Scripting via Plugin Options CVSS 5.5 · 02.02.20245.3BEAR <= 1.1.4 - Missing Authorization via Several Functions CVSS 5.3 · 02.02.202426.03.20246.1BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.4.2 - Reflected Cross-Site Scripting CVSS 6.1 · 26.03.202428.03.20245.3BEAR <= 1.1.4.3 - Missing Authorization CVSS 5.3 · 28.03.202410.04.20245.3BEAR <= 1.1.4.1 & WOLF <= 1.0.8.1 - Cross-Site Request Forgery to Notice Dismissal CVSS 5.3 · 10.04.202414.02.20255.5BEAR <= 1.1.4.4 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 5.5 · 14.02.202530.03.20264.9BEAR <= 1.1.7.1 - Authenticated (Shop manager+) SQL Injection CVSS 4.9 · 30.03.202607.04.20264.3BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery to Taxonomy Term Deletion CVSS 4.3 · 07.04.20266.5BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery to Product Data Modification CVSS 6.5 · 07.04.202607.05.20264.3BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery CVSS 4.3 · 07.05.202629.06.20267.2BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.8 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 29.06.2026

Strategic Overview

Avg CVSSMedium
5.1/ 10
Patch Coverage100%
Open

0

Fixed

24

Get automatic notifications for all BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.2CVE-2026-57320

BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.8 - Unauthenticated Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

24 records
2026-06-29 00:00CVE-2026-57320
7.2
High
BondsYes
2026-05-07 00:00CVE-2026-27415
4.3
Medium
benzdeusYes
2026-04-07 00:00CVE-2026-1673
4.3
Medium
Dmitrii IgnatyevYes
2026-04-07 00:00CVE-2026-1672
6.5
Medium
Dmitrii IgnatyevYes
2026-03-30 00:00CVE-2026-45213
4.9
Medium
darooYes
2025-02-14 00:00CVE-2025-26775
5.5
Medium
satrya wira yudhaYes
2024-04-10 00:00CVE-2024-31430
5.3
Medium
Dhabaleshwar DasYes
2024-03-28 00:00CVE-2024-30463
5.3
Medium
Dhabaleshwar DasYes
2024-03-26 00:00CVE-2024-30200
6.1
Medium
Rafie MuhammadYes
2024-02-02 00:00CVE-2024-24834
5.5
Medium
Kévin Mosbahi (Mika)Yes
Showing 1–10 of 24 reports
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) banner
Latestv1.2.3

BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)

RealMag777

Author

RealMag777

4.7(227)
94/100
Last Updated
2026-09-11 (2d ago)
Active Installs
40,000+
Downloads
785,543
Requires WP
6.0+
Requires PHP
7.4+
Tested up to
WP 7.1
Created
2018-05-07 (9y ago)
Requires Plugins
woocommerce

BEAR – WooCommerce Bulk Editor and Products Manager Professional (former name is WOOBE) is WordPress plugin for woocommerce bulk edit woocommerce products in the robust and flexible way! With a built-in MCP server, so an AI assistant like Claude or ChatGPT can work with your catalogue directly. 🖥️ Latest PHP 8.x.x – COMPATIBLE! WooCommerce compatibility: from v.6.0 to the latest WooCommerce version. 🔗 Backend demo request here ⚠️ ATTENTION! For WordPress posts, pages and custom post types use plugin WPBE – WordPress Posts Bulk Editor Professional 🌐 Documentation: https://bulk-editor.com/documentation/ 🤖 MCP Server: https://bulk-editor.com/document/mcp-server/ 🎥 Video tutorials: https://bulk-editor.com/video/ 🔧 Support: https://pluginus.net/support/forum/woobe-woocommerce-bulk-editor-professional/ BEAR is a WooCommerce bulk editor and product manager: it edits many products at once from one screen, instead of opening each product separately. It is also the first WooCommerce bulk editor with a built-in MCP server, so an AI assistant like Claude or ChatGPT can work with your catalogue directly. What people use BEAR for: Change prices for many WooCommerce products at once – set a new price, add or subtract a percentage or a fixed amount Bulk edit stock, SKU, status, categories, tags, attributes and any custom meta field Set sale prices with a start and end date across a whole category Find products by any combination of criteria and edit only those Bulk delete products, and bulk edit variations of variable products Export filtered products to CSV with the columns you choose Undo any bulk operation – every change is recorded and revertible Editing your shop with an AI assistant BEAR ships an MCP server, the open standard for connecting AI assistants to software. Connect Claude, ChatGPT in developer mode, or an agent of your own, and manage the shop by describing what you want: Raise prices 20% on everything red What sold best last season, and what has not moved since spring? Which variation gets returned most often? How many days of stock do I have left at the current rate? Discount the “winter” category 30% until Sunday Export a price list for these products as CSV Every change is previewed before it is written and can be rolled back with one click. How to connect an AI assistant Bulk Editor Benefits: 🤖 AI Assistant (MCP Server) – connect Claude, ChatGPT or your own agent and manage the shop in plain language: filter, bulk edit, check what sells, export CSV – with a preview before every change and rollback from History 🛠️ Bulk Editing of all WooCommerce fields: attributes, categories, tags, custom taxonomies, meta fields 🗑️ Bulk Delete Operations – delete products in bulk using criterias combination 🔄 Bulk Operations with variable products variations 🔍 Filtering by all WooCommerce products fields for further bulk editing or export 📤 Products Export using native WooCommerce data format which allows import data back using native WooCommerce importer 📜 History of Bulk and Solo operations with roll-back possibility 🔢 Add necessary Meta Fields to the system and manage by them. JSONed (serialized) metadata bulk editing is possible with nice popup where data constructor is in-built! 💲 Price Calculator for decimal fields 🔧 Advanced operations with variable products and their variations ✏️ Binded editing – edit several products with two clicks! 💸 Change prices relatively 🖊️ Nice and convenient WooCommerce Products Editor with rich HTML elements ⏱️ Instant saving of entered data by AJAX 🔗 Automatic attach of any taxonomies related to the products for further editing 🤝 POSSIBILITY of joint editing of the products without interference to each other. 📋 Profiles for any set of columns for quick loading 🔄 Profiles for any filters combination for quick loading 📚 Documentation: https://bulk-editor.com/documentation/ and https://bulk-editor.com/video/ 🔧 Support: https://pluginus.net/support/forum/woobe-woocommerce-bulk-editor-professional/ 🌟 The Premium version: https://bulk-editor.com/downloads Fields possible to edit in FREE version of the plugin: 🖼️ Thumbnail 📝 Title 🖊️ Description 📅 Status 💵 Regular price 🏷️ Sale price 🔢 SKU 📦 Stock 📅 Date 🏷️ Categories 📂 Download files ⬆️ Upsells 🔗 Grouped products ⚖️ Weight 📏 Length, Width, Height 🔢 Parent ID (for variations) 🔢 Menu order 🏷️ 1 attribute 🧩 2 custom meta fields 🤖 Limited count of products 🌟 See all fields available in Premium 🎥 Plugin Overview on YouTube 🔗 Buy Premium version Related Plugins: &#9989; HUSKY – Products Filter Professional for WooCommerce: products filter plugin for WooCommerce that allows your customers filter products by categories, attributes, products tags, products custom taxonomies and price – a must have plugin for your WooCommerce online store! &#9989; WOOT – WooCommerce Active Products Tables: is WooCommerce plugin for displaying shop products in table format. Tables makes focus for your buyers on the things they want to get, nothing superfluous, just what the client wants, and full attention to what is offered! &#9989; FOX – Currency Switcher Professional for WooCommerce: is WooCommerce multi currency plugin, that allows your site visitors switch products prices currencies according to set currencies rates in the real time and pay in the selected currency (optionally). Allows to add any currency for WooCommerce store! &#9989; MDTF – Meta Data Filter and Taxonomies Filter: the plugin for filtering and searching WordPress content in posts and their custom types by taxonomies and meta data fields. The plugin has very high flexibility thanks to its rich filter elements and in-built meta fields constructor! &#9989; TABLEON – WordPress Post Tables Filterable: WordPress plugin for displaying site posts and their custom post types in table format. Tables makes focus for your customers on the things they want to get, nothing superfluous, just what the client wants, and full attention to what is offered! &#9989; WPCS – WordPress Currency Switcher: is a WordPress plugin that allows to switch currencies and get their rates converted in the real time on your site! &#9989; WOLF – WordPress Posts Bulk Editor Professional: is WordPress plugin for managing and bulk edit WordPress posts, pages and custom post types data in robust and flexible way! Be professionals with managing data of your site! &#9989; Taxonomy Chain Menu: is WordPress plugin with one shortcode, which allows to create taxonomies terms chain menus using dropdowns with inbuilt or custom types of WordPress taxonomies. License This plugin is copyright pluginus.net &copy; 2012-2026 with GNU General Public License by realmag777. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY. See the GNU General Public License for more details.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C