CVE-2023-4938

Name of the Vulnerable Software and Affected Versions The BEAR for WordPress versions up to, and including, 1.1.3.3

Description The issue is related to Missing Authorization due to a missing capability check on the woobe bulkoperations apply default combination function. This allows authenticated attackers, with a role of subscriber or higher, to manipulate products.

Recommendations For versions up to, and including, 1.1.3.3, update to a version that includes a fix for the missing capability check on the woobe bulkoperations apply default combination function. As a temporary workaround, consider restricting access to the woobe bulkoperations apply default combination function until a patch is available.