The vulnerability is a CSRF flaw that permits an attacker to cause an authenticated user of the BEAR WordPress plugin to unknowingly submit requests that execute privileged actions. The impact is that the attacker can perform any operation that the victim’s privileges allow, potentially altering plugin settings or data. The weakness is identified as CWE‑352, a flaw in validating request authenticity.

The affected product is the BEAR WordPress plugin (PluginUs.Net) and all installations of versions up to and including 1.1.5. No specific version triage beyond the stated maximum is provided.

The CVSS base score of 4.3 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, so there is no evidence of widespread exploitation. Based on the description, it is inferred that the likely attack vector is a standard CSRF scenario where an attacker directs a logged-in administrator to a crafted URL or link that triggers the malicious action. No prerequisite such as local code execution is required beyond a user session.