WooCommerce Photo Reviews CVE-2026-111404

Exploitation requires triggering the improperly synchronized operation in the Photo Reviews for WooCommerce plugin (woo-photo-reviews) at or below version 1.2.31, running on a WordPress site with WooCommerce active. Per the CVSS vector it needs no authentication or user interaction (PR:N/UI:N) and is reachable over the network (AV:N), but the high attack complexity (AC:H) means the attacker must reliably win a race-condition timing window that is not under their direct control - the key limiting factor that makes practical exploitation difficult. The available sources do not describe which specific plugin feature or request path contains the race, so the exact trigger is not described in the available sources. Impact is confined to a limited integrity effect (I:L), with no confidentiality or availability consequences.

This is a low-severity issue that does not warrant emergency prioritization. The CVSS 3.1 base score is 3.7 (Low), driven by a network vector (AV:N) and no privileges or user interaction (PR:N/UI:N), but tempered by high attack complexity (AC:H) and only a low integrity impact (I:L) with no confidentiality or availability impact (C:N/A:N). The AC:H reflects that winning a race condition (CWE-362) typically requires precise timing the attacker does not fully control. No EPSS score, CISA KEV listing, or SSVC automatable/technical-impact values were supplied; the only decision signal is the vuln.today priority label 'monitor', which is consistent with the low CVSS. There is no confirmed active exploitation and no verified working exploit code - only the Patchstack database entry. Note a tagging tension: the record carries an 'Information Disclosure' tag, yet the CVSS vector sets C:N and scores only integrity (I:L); the official metrics do not support a confidentiality-loss framing, so treat the information-disclosure label as unverified. Overall this is a genuine but marginal, hard-to-exploit flaw appropriate for routine patch cycles rather than urgent response.

A remote unauthenticated attacker repeatedly submits concurrent requests to the plugin's photo-review handling in an attempt to win a timing window and cause a limited, unauthorized modification of state (I:L). Because attack complexity is high, success depends on precisely racing the vulnerable operation, which is not reliably attacker-controlled. No verified working exploit code is available; only a Patchstack advisory reference exists.