CVE-2026-100517 in Photo Reviews Plugin
Summary
by MITRE • 10/01/2026
Unauthenticated Insecure Direct Object References (IDOR) in Photo Reviews for WooCommerce <= 1.2.30 versions.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified as an Unauthenticated Insecure Direct Object Reference within the Photo Reviews plugin for WordPress, specifically affecting versions up to and including 1.2.30, represents a critical failure in access control mechanisms that allows attackers to manipulate object identifiers directly without proper authorization checks. This flaw stems from the application's reliance on user-supplied input, such as product IDs or review metadata parameters passed via HTTP requests, to determine which data objects should be retrieved or modified by the database backend. In secure software architecture, any request targeting a specific resource must verify that the authenticated session of the requester possesses explicit permissions for that particular object. However, in this implementation, the server processes these direct references blindly, assuming that if an identifier is provided, it is valid and accessible to the caller, thereby bypassing essential authentication and authorization layers entirely.
From a technical perspective, the exploitation vector typically involves crafting malicious HTTP requests where parameters like product_id or review_id are manipulated to point towards resources belonging to other users or sensitive administrative data structures not intended for public consumption. Because the vulnerability is unauthenticated, an attacker does not need valid credentials to initiate these attacks, significantly lowering the barrier to entry and increasing the likelihood of automated exploitation at scale. The application fails to implement proper indirect object references where a mapping layer translates user-facing identifiers into internal database keys, nor does it enforce ownership verification before executing queries against the underlying MySQL or MariaDB databases. This architectural oversight aligns directly with CWE-639, which categorizes Insecure Direct Object References as a flaw in access control logic that allows unauthorized data modification or disclosure through direct manipulation of object references.
The operational impact of this vulnerability is severe, potentially leading to both information disclosure and integrity compromise depending on the specific endpoints exposed by the plugin's API functions. Attackers can enumerate valid product IDs within the WooCommerce store, extracting sensitive details such as customer names, email addresses associated with reviews, pricing strategies, or inventory levels that are not publicly displayed on the frontend interface. Furthermore, if the affected code paths allow for write operations rather than just read access, an attacker could potentially create fake positive reviews to manipulate search engine rankings and consumer trust, delete legitimate negative feedback to skew reputation metrics, or inject malicious content into review fields that may be rendered without proper sanitization in subsequent page loads. This capability undermines the integrity of user-generated content platforms and erodes customer confidence in e-commerce transactions facilitated by the compromised site.
This vulnerability maps closely to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, if used for further exploitation chains, but more accurately aligns with T1213, Data from Information Repositories, as it facilitates unauthorized access to stored data without authentication. The lack of input validation on object identifiers also touches upon CWE-20, Improper Input Validation, indicating a broader pattern of defensive coding failures within the plugin's development lifecycle. To mitigate this risk immediately, administrators must upgrade the Photo Reviews plugin to version 1.2.31 or later where these access control checks have been implemented. In cases where immediate patching is not feasible due to compatibility constraints with other plugins or custom code modifications, temporary mitigations include restricting direct file system access to wp-content/plugins/photo-reviews via web server configuration rules such as Apache mod_rewrite or Nginx deny directives for specific API endpoints that handle review data retrieval and submission. Additionally, implementing a Web Application Firewall rule set capable of detecting anomalous patterns in parameter values associated with product IDs can provide an additional layer of defense against automated scanning tools targeting this known weakness until the software is fully updated.