What is the CVSS score of EUVD-2026-55018?

EUVD-2026-55018 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for EUVD-2026-55018?

Yes, a public proof-of-concept exploit is available for EUVD-2026-55018. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for EUVD-2026-55018?

Yes, a patch is available for EUVD-2026-55018. Update the affected software to the latest version immediately.

Customer Reviews WooCommerce EUVD-2026-55018

| CVE-2026-14941 MEDIUM

Missing Authorization (CWE-862)

2026-08-10 WPScan

GHSA-qjgh-5372-g9qg

WordPress Authentication Bypass Customer Reviews For Woocommerce Unknown

5.4

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

PR:L confirmed by description requiring Subscriber account; C:L and I:L reflect settings disclosure and modification; no availability impact or scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 23:44 vuln.today

CVSS changed

Aug 11, 2026 - 21:22 NVD

5.4 (MEDIUM)

Patch available

Aug 10, 2026 - 08:02 EUVD

CVE Published

Aug 10, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 10, 2026 - 06:00 cve.org

MEDIUM 5.4

DescriptionCVE.org

The Customer Reviews for WooCommerce WordPress plugin before 5.116.0 does not perform nonce or capability checks on several settings-related AJAX actions, allowing users with minimal permissions such as Subscribers to invoke administrative settings handlers, update Customer Reviews for WooCommerce WordPress plugin before 5.116.0 options, and disclose store configuration.

AnalysisAI

Missing authorization on multiple AJAX settings handlers in Customer Reviews for WooCommerce (all versions before 5.116.0) allows any authenticated WordPress user - including low-privilege Subscribers - to invoke administrative settings functions, overwrite plugin configuration options, and read sensitive store configuration data. The flaw stems from absent nonce verification and WordPress capability checks on AJAX actions that should be restricted to shop administrators. A public exploit exists via WPScan, though EPSS signals low widespread opportunistic exploitation at 0.14% (4th percentile); no CISA KEV listing indicates mass exploitation has not been observed.

Technical ContextAI

WordPress AJAX handlers registered via the wp_ajax_ hook are accessible to any authenticated user unless the plugin explicitly calls wp_verify_nonce() (CSRF protection) and current_user_can() (capability gating). CWE-862 (Missing Authorization) is the root cause: the plugin registers several settings-related AJAX actions but omits these guards entirely, meaning WordPress's role and capability system is bypassed at the plugin layer. The Subscriber role - the default role for any registered user on an open-registration WordPress site - is sufficient to trigger these handlers. The affected CPE cpe:2.3:a:unknown:customer_reviews_for_woocommerce:*:*:*:*:*:*:*:* covers all plugin versions from inception through 5.115.x. Because WooCommerce stores often hold customer PII and payment configuration, unauthorized reads of plugin settings carry meaningful disclosure risk beyond the plugin itself.

RemediationAI

Update Customer Reviews for WooCommerce to version 5.116.0 or later, which adds the missing nonce verification and WordPress capability checks to the affected AJAX settings handlers. The fix is confirmed available from the vendor and documented by WPScan at https://wpscan.com/vulnerability/572ba4a2-1b51-4631-9c28-7cc3d44f0761/. If immediate patching is not feasible, a targeted compensating control is to disable open user registration on the WordPress site (Settings → General → uncheck 'Anyone can register'), which removes the ability for unauthenticated visitors to obtain the Subscriber account prerequisite. Note this workaround does not protect against exploitation by already-registered users. Additionally, a WAF rule blocking unauthenticated or low-privilege AJAX requests to the plugin's specific action names can provide interim layered defense, though action name enumeration may be required to implement this precisely.