← Back to the live CVE advisory feed

CVE-2026-89055: Customer Reviews for WooCommerce

Severity

9.1 (CRITICAL)

Vendor

IVOLE

Affected versions

0 through 5.120.0

Patch status

Unknown

Published

2026-09-25T07:16:55.140

Modified

2026-09-25T07:16:55.140

Why it matters

This matters because the affected product may be exposed on public websites. A vulnerable plugin can create a direct path to site compromise, malicious code deployment, or data theft.

Recommended admin actions

• Prioritize validation immediately due to critical CVSS severity.
• Check whether the affected WordPress plugin or theme is installed.
• Update, disable, or remove the affected component if present.
• Treat internet-facing systems as higher priority.
• Review logs for suspicious activity related to the affected application or component.

Technical summary

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.120.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary attachments from the Media Library — including administrator-owned product images, logos, and documents — by injecting their IDs into a review that is later trashed and purged. Exploitation requires a public review-form link (a 13-hex formId distributed to customers via e-mail), which exposes the nonce needed to reach the handler without any WordPress account or session.

View the official NVD record for CVE-2026-89055

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.