CVE-2026-27415 MEDIUM

CVE-2026-27415: WordPress BEAR plugin <= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerability

Vendor Pluginus.net

Product BEAR

Weakness CWE-352 · CSRF

Published May 7, 2026

Last update May 7, 2026

View on NVD All CVEs

CVSS base score

4.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in PluginUs.Net BEAR allows Cross Site Request Forgery. This issue affects BEAR: from n/a through 1.1.5.

Explanation of Vulnerability in Simple Terms

02Summary

BEAR versions up to 1.1.5 contain a cross-site request forgery (CSRF) vulnerability that allows attackers to perform unwanted actions on behalf of authenticated users. The vulnerability requires user interaction—typically clicking a malicious link or visiting a compromised page. An attacker cannot read data or disrupt service, but can modify site content or settings if a logged-in admin or user visits their crafted page.

What an attacker can do

03Attacker Capabilities

Perform unwanted actions (modify content, change settings) on behalf of a logged-in user without their knowledge.

Potential impact on your site

04Site Impact

Admins or users could unknowingly authorize changes to site content, settings, or user accounts if tricked into visiting a malicious page.

Conditions required to exploit

05Prerequisites

Target user must be logged in and click a malicious link or visit an attacker-controlled page.

Key dates

06Disclosure timeline

May 7, 2026 CVE published

May 7, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-27415 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/352.html AskarLabs — CWE-352 write-up Cross-Site Request Forgery

Related vulnerabilities