CVE-2026-84025: Unknown Bear

Low severity, CVSS 2.2. EPSS: 0.2% chance of exploitation in the next 30 days.

The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing users who are restricted to their own products to read other owners' product information, including protected downloadable file URLs and private product metadata.

Affected products

• Unknown Bear: before 1.2.2 (fixed in 1.2.2)

Published 2026-09-12. Last modified 2026-09-14.