CVE-2026-101923 in Photo Reviews Plugin
Summary
by MITRE • 10/03/2026
The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Arbitrary Content Deletion in versions up to, and including, 1.2.30. This is due to the plugin storing attacker-controlled post IDs from the wcpr_image_upload_id parameter of a public review submission into the review's reviews-images comment meta without verifying that the IDs correspond to attachments owned by the submitter, combined with the delete_reviews_image() handler unconditionally calling wp_delete_post( $id, true ) on every stored ID when the review is deleted. This makes it possible for unauthenticated attackers to permanently delete arbitrary posts, pages, products, or media attachments on the site whenever an administrator subsequently deletes the attacker's review (or when WordPress's built-in wp_scheduled_delete cron empties the comment trash after 30 days).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/03/2026
The vulnerability identified in Photo Reviews for WooCommerce versions up to and including 1.2.30 represents a critical Arbitrary Content Deletion flaw rooted in insufficient input validation during the handling of user-generated content. The core technical defect lies in how the plugin processes data from the wcpr_image_upload_id parameter, which is part of the public review submission interface. When an attacker submits a review containing maliciously crafted post IDs within this parameter, the plugin stores these values directly into the reviews-images comment meta field associated with that specific review entry. Crucially, the application fails to verify whether the provided post identifiers actually correspond to attachments or content owned by the submitting user. This lack of ownership verification allows an attacker to inject references to any publicly accessible or otherwise reachable resource within the WordPress database structure, effectively bypassing standard access controls intended to isolate user data.
The operational impact of this flaw is severe because it enables unauthenticated attackers to achieve permanent deletion of arbitrary site content. The mechanism for exploitation relies on a two-stage process involving both immediate action and scheduled cleanup routines. Initially, when an administrator deletes the attacker's review through the WordPress admin interface, or when the built-in wp_scheduled_delete cron job automatically empties the comment trash after thirty days, the plugin invokes the delete_reviews_image handler function. This handler iterates over all stored image IDs associated with the deleted review and unconditionally passes them to the core WordPress function wp_delete_post with the force parameter set to true. Consequently, any post ID injected by the attacker during the initial submission phase is permanently removed from the database, regardless of its original ownership or type.
This vulnerability affects a wide range of content types including standard posts, pages, WooCommerce products, and media attachments. The ability to delete arbitrary products can directly impact e-commerce operations by removing inventory listings, while the deletion of general posts or pages can disrupt site navigation and informational integrity. Furthermore, because the attack vector is unauthenticated, any visitor with access to the public review submission form can execute this denial-of-service style attack without needing valid credentials. The persistence of the threat is compounded by the fact that even if an administrator does not manually delete reviews, WordPress's default behavior of purging trashed comments after thirty days will eventually trigger the deletion routine, ensuring that maliciously injected IDs are processed and resulting in data loss over time.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation, as the application fails to adequately sanitize or validate user-supplied input before processing it. Additionally, it relates to CWE-611 Improper Restriction of XML External Entity References if one considers the broader context of IDOR-like behaviors where object references are not properly validated against access controls, though in this specific case, the primary issue is the lack of ownership verification for post IDs leading to unauthorized state changes. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior can be categorized under T1485 Data Destruction, specifically involving the deletion of data from local systems or databases. The attack path involves initial access via a public-facing endpoint followed by privilege escalation in effect through administrative actions that trigger the malicious code execution flow.
Mitigation strategies must focus on immediate remediation and future hardening. Administrators should update the Photo Reviews for WooCommerce plugin to version 1.2.31 or later, where this validation logic has been corrected. In cases where updating is not immediately feasible, temporary workarounds include restricting access to the review submission endpoint if possible, although given its public nature, this may impact legitimate user engagement. More robustly, developers should implement strict ownership verification by querying the database to confirm that the post ID provided in wcpr_image_upload_id belongs to the current user or is publicly accessible and intended for attachment before storing it in comment meta. Furthermore, when processing deletions via delete_reviews_image, the application must validate each ID against a whitelist of allowed resources associated with the specific review being deleted, ensuring that only images legitimately uploaded by the reviewer are subject to deletion routines. Regular security audits focusing on input validation and access control checks for all user-controllable parameters in public-facing forms are essential to prevent similar vulnerabilities.