Revopic Photo Reviews For Woocommerce
Monthly
Unauthenticated attackers can permanently delete arbitrary WordPress Media Library attachments - including the files on disk - on any site running VillaTheme's Revopic / Photo Reviews for WooCommerce plugin through version 1.2.31. The plugin accepts attacker-chosen attachment IDs through the wcpr_image_upload_id POST parameter and stores them in review comment meta; the only validation confirms the ID is an attachment post type, never that the submitter owns or uploaded it, and the required wcpr_image_upload nonce is a shared public value printed on every product page. Deletion is deferred rather than immediate: it fires through the delete_comment hook when a moderator removes the planted review or when WordPress core's wp_scheduled_delete cron purges the trashed comment after EMPTY_TRASH_DAYS, and exploitation additionally requires enumerable target attachment IDs; no public exploit code or confirmed active exploitation was identified at time of analysis, and the assigned priority is this_month.
Unauthenticated attackers can permanently delete arbitrary WordPress Media Library attachments - including the files on disk - on any site running VillaTheme's Revopic / Photo Reviews for WooCommerce plugin through version 1.2.31. The plugin accepts attacker-chosen attachment IDs through the wcpr_image_upload_id POST parameter and stores them in review comment meta; the only validation confirms the ID is an attachment post type, never that the submitter owns or uploaded it, and the required wcpr_image_upload nonce is a shared public value printed on every product page. Deletion is deferred rather than immediate: it fires through the delete_comment hook when a moderator removes the planted review or when WordPress core's wp_scheduled_delete cron purges the trashed comment after EMPTY_TRASH_DAYS, and exploitation additionally requires enumerable target attachment IDs; no public exploit code or confirmed active exploitation was identified at time of analysis, and the assigned priority is this_month.