Skip to main content

Customer Reviews For Woocommerce CVE-2024-1044

MEDIUM
Improper Access Control (CWE-284)
2024-02-29 security@wordfence.com
WordPress Authentication Bypass Customer Reviews For Woocommerce Wordpress Plugin Cusrev
5.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

1
CVE Published
Feb 29, 2024 - 01:43 nvd
MEDIUM 5.3

DescriptionCVE.org

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submit_review' function in all versions up to, and including, 5.38.12. This makes it possible for unauthenticated attackers to submit reviews with arbitrary email addresses regardless of whether reviews are globally enabled.

AnalysisAI

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submit_review' function in all versions up to,. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-284. The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submit_review' function in all versions up to, and including, 5.38.12. This makes it possible for unauthenticated attackers to submit reviews with arbitrary email addresses regardless of whether reviews are globally enabled. Affected products include: Cusrev Customer Reviews For Woocommerce.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Customer Reviews For Woocommerce

View all
CVE-2026-76585 HIGH POC
8.8 Aug 30

Stored Cross-Site Scripting in Customer Reviews for WooCommerce (all versions before 5.118.0) lets unauthenticated attac
CVE-2023-0080 HIGH POC
8.8 Feb 13

The Customer Reviews for WooCommerce WordPress plugin before 5.16.0 does not validate one of its shortcode attribute, wh
CVE-2026-12684 MEDIUM POC
6.5 Jul 16

Unauthenticated media file upload in the Customer Reviews for WooCommerce WordPress plugin (all versions before 5.113.0)
CVE-2023-6979 HIGH
8.8 Jan 11

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file ty
CVE-2026-14941 MEDIUM POC
5.4 Aug 10

Missing authorization on multiple AJAX settings handlers in Customer Reviews for WooCommerce (all versions before 5.116.
CVE-2022-38470 HIGH
8.8 Sep 23

Cross-Site Request Forgery (CSRF) vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress. Rated

CVE-2022-38134 HIGH
8.8 Sep 23

Authenticated (subscriber+) Broken Access Control vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at W
CVE-2022-40194 HIGH
7.5 Sep 23

Unauthenticated Sensitive Information Disclosure vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at Wo
CVE-2026-6176 HIGH
7.2 Aug 28

Stored cross-site scripting in the Customer Reviews for WooCommerce WordPress plugin (versions up to and including 5.106
CVE-2026-13771 MEDIUM
6.4 Jul 09

Stored Cross-Site Scripting in the Customer Reviews for WooCommerce WordPress plugin (all versions ≤ 5.113.0) allows con
CVE-2024-3731 MEDIUM
6.1 Apr 19

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' pa
CVE-2026-3355 MEDIUM
6.1 Apr 16

Reflected Cross-Site Scripting in Customer Reviews for WooCommerce plugin allows unauthenticated attackers to inject arb

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2024-1044 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy