CVE-2026-45213

The BEAR WordPress plugin (woo-bulk-editor) contains a blind SQL injection vulnerability due to improper neutralization of special elements used in an SQL command. This flaw is present in versions through 1.1.7.1 [1].

Attackers can exploit this vulnerability by sending crafted HTTP requests to the plugin's endpoints, potentially without requiring authentication. The blind nature of the injection means an attacker can extract data through boolean or time-based queries, making it suitable for automated mass-exploit campaigns [1].

The impact is significant: a successful attacker can directly interact with the underlying database, leading to theft of sensitive information such as user credentials, personal data, or configuration details [1].

As a mitigation, users should update to version 1.1.8 or later, where the issue is fixed. Patchstack users can enable auto-updates for vulnerable plugins [1].