What is the CVSS score of CVE-2026-4664?

CVE-2026-4664 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

WordPress CVE-2026-4664

EUVD-2026-21264 MEDIUM

Improper Authentication (CWE-287)

2026-04-10 Wordfence

WordPress Authentication Bypass

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 10, 2026 - 01:45 euvd

EUVD-2026-21264

Analysis Generated

Apr 10, 2026 - 01:45 vuln.today

CVE Published

Apr 10, 2026 - 01:24 nvd

MEDIUM 5.3

DescriptionCVE.org

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.103.0. This is due to the create_review_permissions_check() function comparing the user-supplied key parameter against the order's ivole_secret_key meta value using strict equality (===), without verifying that the stored key is non-empty. For orders where no review reminder email has been sent, the ivole_secret_key meta is not set, causing get_meta() to return an empty string. An attacker can supply key: "" to match this empty value and bypass the permission check. This makes it possible for unauthenticated attackers to submit, modify, and inject product reviews on any product - including products not associated with the referenced order - via the REST API endpoint POST /ivole/v1/review. Reviews are auto-approved by default since ivole_enable_moderation defaults to "no".

AnalysisAI

Unauthenticated attackers can bypass authentication in Customer Reviews for WooCommerce plugin versions up to 5.103.0 by submitting an empty string as the review permission key, allowing them to create, modify, and inject malicious product reviews via the REST API without any legitimate order association. The vulnerability exploits improper key validation using strict equality comparison without checking for empty values, combined with auto-approval of reviews by default, enabling widespread review injection across all products on affected WooCommerce installations.

Technical ContextAI

The vulnerability exists in the create_review_permissions_check() function within the Customer Reviews for WooCommerce plugin (CPE: cpe:2.3:a:ivole:customer_reviews_for_woocommerce:*:*:*:*:*:*:*:*). The root cause is a CWE-287 (Improper Authentication) flaw where the function uses strict equality (===) to compare a user-supplied key parameter against the order's ivole_secret_key meta value without validating that the stored key is non-empty. When review reminder emails have not been sent for an order, the ivole_secret_key meta field remains unset, causing WordPress's get_meta() function to return an empty string as a default value. An attacker can exploit this by supplying key: "" to match the empty meta value and bypass the permission check entirely. The REST API endpoint POST /ivole/v1/review processes these requests without proper authentication, and because ivole_enable_moderation defaults to "no", reviews are automatically published without human review.

RemediationAI

Vendor-released patch: Customer Reviews for WooCommerce version 5.104.0 fixes this vulnerability by implementing proper validation of the review permission key (confirmed via the changeset comparison between tags 5.103.0 and 5.104.0 at https://plugins.trac.wordpress.org/changeset?old_path=%2Fcustomer-reviews-woocommerce/tags/5.103.0&new_path=%2Fcustomer-reviews-woocommerce/tags/5.104.0). Site administrators should immediately update the Customer Reviews for WooCommerce plugin to version 5.104.0 or later through the WordPress plugin dashboard. As an interim mitigation prior to patching, administrators may consider disabling the /ivole/v1/review REST endpoint or implementing Web Application Firewall rules to block requests with empty key parameters to this endpoint, though immediate patching is the recommended primary remediation. Additional hardening includes enabling review moderation by setting ivole_enable_moderation to "yes" to require manual approval of reviews before publication.