Customer Reviews WooCommerce CVE-2026-6176

The attack requires the attacker to possess a valid review form URL for the targeted WooCommerce store; these URLs are embedded in review-reminder emails that the plugin automatically sends to customers after order completion, making them accessible to any individual who has ever placed an order on an affected store. The 'cr_local_forms_submit' AJAX endpoint must be active, meaning the plugin is installed, activated, and the reminder or local-form feature is enabled - a non-default plugin being disabled would eliminate the attack surface entirely. No authentication credentials are required to submit the malicious review payload once the URL is in hand. Exploitation is constrained to individuals who hold an order-linked reminder URL for the specific target store, which prevents anonymous internet-wide mass exploitation but does not stop deliberate targeting by former customers or individuals who obtain the URL through other means (e.g., phishing a customer or purchasing from the store). Impact scales with product page traffic: high-traffic product pages amplify the number of victims who execute the payload after a single injection.

The reported CVSS 3.1 base score of 7.2 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N captures the network-reachable, low-complexity, unauthenticated nature of the injection step and the scope change inherent in cross-site scripting. However, the UI:N designation requires scrutiny: while the attacker submits the payload without user interaction, the impact phase - script execution - requires a victim to navigate to the affected product page, which CVSS 3.1 guidance treats as UI:R; correcting this metric yields a base score of approximately 6.1, which better calibrates operational priority against other vulnerabilities. EPSS data is absent from the available intelligence, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, confirming no verified active exploitation at time of analysis. Despite these moderating signals, the exploitation prerequisite - a review form URL included in plugin-generated order-reminder emails - is routinely delivered to any customer of an affected store, meaning even a mid-sized e-commerce operator in malbork running this plugin faces a realistic risk of deliberate abuse from their own customer base without any attacker needing to perform reconnaissance. The fix (SVN changeset 3510305) has been committed, suggesting defenders should prioritize patching; the stored nature of the payload means a single successful injection persists until removed, multiplying impact across all product-page visitors.

A threat actor who previously purchased from a WooCommerce store running this plugin receives a routine review-reminder email containing a direct link to the product review submission form. Using that URL, the attacker submits a review embedding a JavaScript payload - such as a script that exfiltrates document.cookie to an attacker-controlled endpoint - which the plugin stores unsanitized in the WordPress comments table via wp_insert_comment(). Every subsequent visitor to the affected product page, including authenticated store administrators, silently executes the payload in their browser, enabling session token theft, credential harvesting, or malicious redirects. No public exploit code has been identified at time of analysis, but the technique is mechanically straightforward for anyone with basic XSS knowledge.