EUVD-2026-86540
GHSA-wr5c-7j3m-rjfq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Unauthenticated network attack (PR:N) via an exposed public form nonce; missing authorization enables arbitrary permanent attachment deletion (I:H/A:H), no data disclosure (C:N).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.120.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary attachments from the Media Library - including administrator-owned product images, logos, and documents - by injecting their IDs into a review that is later trashed and purged. Exploitation requires a public review-form link (a 13-hex formId distributed to customers via e-mail), which exposes the nonce needed to reach the handler without any WordPress account or session.
Articles & Coverage 2
AnalysisAI
Permanent deletion of arbitrary WordPress Media Library attachments - including administrator-owned product images, logos and documents - is possible in the Customer Reviews for WooCommerce plugin through version 5.120.0, because a missing authorization check (CWE-862) in the review-submission handler lets an unauthenticated remote attacker inject arbitrary attachment IDs into a review that is later trashed and purged through the normal moderation lifecycle. Exploitation depends on a live public review-form link (a 13-hex formId that the store distributes to customers by e-mail), which exposes the nonce needed to reach the handler without any WordPress account or session, and the impact is integrity/availability only - there is no confidentiality impact (C:N). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a live public review-form link for the target store - a 13-hex formId that the store distributes to customers by e-mail - because that link exposes the WordPress nonce needed to reach the review-submission handler without any account or session. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) reflects a genuinely serious unauthenticated remote integrity/availability flaw: a missing-authorization bug (CWE-862) lets an attacker with no WordPress account permanently delete arbitrary Media Library attachments, including administrator-owned product images, logos and documents. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Move off 5.120.0 as soon as a fixed build is available: the WordPress plugin repository changeset 3694303 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3694303%40customer-reviews-woocommerce&new=3694303%40customer-reviews-woocommerce) indicates that an upstream fix has been committed, but the input data does not independently confirm a tagged released version number beyond 5.120.0, so upgrade to the first release published after 5.120.0 and verify the vendor's changelog before relying on it; the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/b7bbeeea-3888-42a6-8d14-f5c39f5dcb70?source=cve) should be monitored for the confirmed patched version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm exposure by inventorying all WordPress and WooCommerce instances running Customer Reviews for WooCommerce at version 5.120.0 or earlier, and treat any instance with a publicly distributed review-form link (the 13-character hex formId shared with customers by e-mail) as directly reachable by an unauthenticated attacker; if the plugin is not business-critical, deactivate it immediately, and if it must stay online, remove or unpublish public review-form links, regenerate formIds, and deploy a WAF virtual patch blocking unauthenticated POSTs to the review-submission handler and scanning request bodies for attachment-ID parameters. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Stored Cross-Site Scripting in Customer Reviews for WooCommerce (all versions before 5.118.0) lets unauthenticated attac
The Customer Reviews for WooCommerce WordPress plugin before 5.16.0 does not validate one of its shortcode attribute, wh
Unauthenticated media file upload in the Customer Reviews for WooCommerce WordPress plugin (all versions before 5.113.0)
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file ty
Missing authorization on multiple AJAX settings handlers in Customer Reviews for WooCommerce (all versions before 5.116.
Cross-Site Request Forgery (CSRF) vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress. Rated
Authenticated (subscriber+) Broken Access Control vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at W
Remote unauthenticated attackers can delete arbitrary content, including customer reviews, on WordPress/WooCommerce site
Unauthenticated Sensitive Information Disclosure vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at Wo
Stored cross-site scripting (XSS) in the Customer Reviews for WooCommerce plugin for WordPress, all versions up to and i
Stored cross-site scripting in the Customer Reviews for WooCommerce WordPress plugin (versions up to and including 5.106
Stored Cross-Site Scripting in the Customer Reviews for WooCommerce WordPress plugin (all versions ≤ 5.113.0) allows con
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today