Description

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.120.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary attachments from the Media Library — including administrator-owned product images, logos, and documents — by injecting their IDs into a review that is later trashed and purged. Exploitation requires a public review-form link (a 13-hex formId distributed to customers via e-mail), which exposes the nonce needed to reach the handler without any WordPress account or session.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-25T07:16:55.140Z",
  "pubdate": "2026-09-25T07:16:55.140Z",
  "executiveSummary": "The Customer Reviews for WooCommerce plugin for WordPress, in all versions up to and including 5.120.0, contains an authorization bypass vulnerability. This flaw arises from improper access control validation within the plugin's review processing logic.\nThe vulnerability permits unauthenticated attackers to permanently delete arbitrary files from the WordPress Media Library, including critical assets such as product images, corporate logos, and sensitive documentation.\nRisk is significant, as an attacker can cause permanent data loss and service disruption without requiring a valid WordPress account or session. Exploitation relies on the acquisition of a public review-form link containing a 13-hex formId, which leaks the necessary nonce required to interact with the vulnerable backend handler.\nSuccessful exploitation allows unauthorized file deletion, potentially leading to widespread defacement or functional degradation of the WooCommerce storefront.",
  "technicalDetails": "The vulnerability exists due to a failure in the plugin to enforce strict authorization checks on requests routed to the review management handler. The application fails to verify whether the entity submitting or manipulating a review possesses the appropriate permissions to perform delete operations on media assets associated with those reviews.\nThe attack vector centers on the misuse of the review submission process. By manipulating the review lifecycle—specifically by injecting arbitrary Media Library attachment IDs into a review object and subsequently triggering the trash and purge functionality—an attacker can force the deletion of files that are not owned by the reviewer or intended for removal.\nThe exploitation process is as follows: First, the attacker identifies a public review-form link, which is typically distributed via email and identified by a 13-hex character formId. This link exposes the security nonce required to authenticate the request against the plugin's internal handlers.\nSecond, the attacker leverages this nonce to interact with the plugin’s backend processing functions. By crafting a payload that replaces the legitimate attachment IDs in a review submission with IDs corresponding to sensitive files in the WordPress Media Library, the attacker instructs the plugin to associate these files with a newly created review.\nThird, the attacker triggers the deletion routine associated with the review. Because the system fails to validate the authorization context of the deletion request, the server executes the removal of the injected media IDs from the database and the physical storage layer (uploads directory).\nThe vulnerable component is the review handling logic that processes file attachments during the review lifecycle. Since the nonce is leaked via the public-facing review form, the barrier to entry is extremely low, effectively negating the need for administrative or subscriber-level access. The impact is catastrophic in terms of content availability, as the delete operation is permanent and bypasses typical WordPress media permission checks."
}