low2.2
CVE-2026-84025
The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing u…
Impact
The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing users who are restricted to their own products to read other owners' product information, including protected downloadable file URLs and private product metadata.
Affected products
| Product | Affected versions |
|---|---|
| BEAR WordPress Plugin | before 1.2.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.