What is the CVSS score of CVE-2026-12684?

CVE-2026-12684 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-12684?

Yes, a public proof-of-concept exploit is available for CVE-2026-12684. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-12684?

Yes, a patch is available for CVE-2026-12684. Update the affected software to the latest version immediately.

Customer Reviews for WooCommerce CVE-2026-12684

EUVD-2026-44877 MEDIUM

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-16 WPScan

GHSA-22m6-qpwv-v2xp

WordPress File Upload Customer Reviews For Woocommerce

6.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Network vector with no privileges or user interaction required; integrity and availability both low-impact due to file-type allowlist and no code execution; confidentiality unaffected.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 10:04 vuln.today

Patch available

Jul 16, 2026 - 10:18 EUVD

CVE Published

Jul 16, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 16, 2026 - 06:00 cve.org

MEDIUM 6.5

DescriptionCVE.org

The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks on one of its media upload AJAX actions when the review media attachment feature is enabled, allowing unauthenticated users to upload media files (bounded to an image and video allowlist) to the Media Library and create attachment posts, leading to media library pollution and disk space exhaustion.

AnalysisAI

Unauthenticated media file upload in the Customer Reviews for WooCommerce WordPress plugin (all versions before 5.113.0) allows any remote user to push image and video files directly into the WordPress Media Library, leading to media library pollution and disk space exhaustion. The flaw is conditionally exploitable - the plugin's review media attachment feature must be enabled - but when active, requires no credentials, nonce, or capability check on the affected AJAX action. No active exploitation is confirmed in CISA KEV, though a publicly available proof-of-concept has been published by WPScan, and the SSVC framework flags the attack as automatable.

Technical ContextAI

The vulnerability exists in the WordPress AJAX handling layer of the Customer Reviews for WooCommerce plugin (CPE: cpe:2.3:a:unknown:customer_reviews_for_woocommerce:*:*:*:*:*:*:*:*). WordPress AJAX actions registered without proper wp_verify_nonce(), current_user_can(), or authentication checks are accessible to unauthenticated visitors via wp-admin/admin-ajax.php. CWE-434 (Unrestricted Upload of File with Dangerous Type) is the root cause class, though the impact is partially mitigated by an image and video MIME-type allowlist that prevents arbitrary executable file upload. The lack of nonce validation is particularly significant - nonces are the primary CSRF and replay-attack defence for WordPress AJAX endpoints, and their absence here enables automated, scripted abuse. The created attachment posts persist in the database alongside uploaded files, compounding cleanup complexity.

RemediationAI

Upgrade the Customer Reviews for WooCommerce plugin to version 5.113.0 or later, which introduces the missing authentication, capability, and nonce checks on the affected AJAX action. The patch is confirmed available from the vendor per the WPScan advisory (https://wpscan.com/vulnerability/169d3455-dd98-4b0b-b6c1-6c9c28aa9707/). If immediate upgrade is not feasible, disabling the review media attachment feature within the plugin's settings eliminates the vulnerable code path entirely - this is the most effective workaround and has no impact on other plugin functionality. As a secondary compensating control, Web Application Firewall rules can be configured to block unauthenticated POST requests to wp-admin/admin-ajax.php with the specific action parameter associated with the media upload handler, though this requires identifying the exact action name from the plugin source. Restricting write permissions to the WordPress uploads directory via server configuration (e.g., disabling uploads from non-authenticated contexts at the web server level) may also limit impact but could interfere with legitimate plugin functionality.