WooCommerce Photo Reviews EUVD-2026-114611

The affected product is VillaTheme's Revopic / Photo Reviews for WooCommerce plugin (versions ≤ 1.2.31) with guest/front-end review submission reachable, so an unauthenticated attacker can POST the wcpr_image_upload_id parameter; the required wcpr_image_upload nonce is a shared public value rendered on every product page and does not act as an authentication barrier. Exploitation does not execute immediately: the deletion fires via the delete_comment hook only when a moderator removes the planted review or when WordPress core's wp_scheduled_delete cron purges the trashed comment after EMPTY_TRASH_DAYS - this deferred, interaction-dependent trigger (reflected as UI:R) is the main practical limiter, along with the attacker needing valid target attachment IDs, which are typically sequential and enumerable.

Signals point to a real but non-emergency medium-severity issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L, base 5.4) shows a network-reachable, low-complexity, unauthenticated flaw whose impact is limited to integrity and availability (arbitrary media deletion) with no confidentiality loss, and which requires a user-interaction trigger - a moderator removing the malicious review, or WordPress core's wp_scheduled_delete cron purging it after EMPTY_TRASH_DAYS. The vuln.today Decision label is this_month rather than act_now/emergency, consistent with that indirect, time-delayed trigger. No EPSS score, no KEV listing, and no verified public exploit code are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this is a credible destructive-data flaw found by Wordfence rather than a mass-exploited one. One classification caveat: the record carries CWE-22 and a 'Path Traversal' tag, but the described mechanism is a missing ownership/capability check on attacker-supplied attachment IDs (an insecure direct object reference), not directory traversal - verify against the Wordfence advisory. Net: worth patching this cycle because exploitation is trivial and the impact (permanent, irreversible deletion of any media library attachment and its on-disk files) is serious, but the moderator-dependent trigger and lack of exploitation signals keep it below drop-everything urgency.

An unauthenticated attacker submits a product review on an affected store, embedding chosen WordPress attachment IDs in the wcpr_image_upload_id POST parameter using the public wcpr_image_upload nonce printed on every product page. When a moderator later deletes that review (or core's wp_scheduled_delete cron purges it after EMPTY_TRASH_DAYS), the delete_comment hook fires delete_reviews_image() and permanently deletes those attachments and their files on disk. No public exploit code is identified at time of analysis; exploitation relies on the deferred moderation/cron trigger reflected in UI:R.