CVE-2026-96823 in Customer Reviews Plugin
Summary
by MITRE • 09/30/2026
Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce <= 5.120.0 versions.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified as an unauthenticated arbitrary content deletion flaw within the WooCommerce plugin, specifically affecting versions up to and including 5.120.0, represents a critical security deficiency that compromises the integrity of e-commerce platforms built on WordPress. This issue stems from insufficient access control mechanisms in the backend administrative interfaces or API endpoints responsible for managing customer reviews. In a properly secured application, actions such as deleting user-generated content like product reviews should require authentication and authorization checks to ensure that only authorized administrators can perform such operations. However, due to flawed logic or missing validation steps, an attacker who is not logged into the WordPress dashboard can exploit this weakness to remove specific review entries at will. This type of vulnerability falls squarely under CWE-284, which describes Improper Access Control, and it aligns with MITRE ATT&CK technique T1078, Valid Accounts, although in this case, no valid account is required for the initial exploitation phase, making it an unauthenticated attack vector that significantly lowers the barrier to entry for malicious actors.
The technical mechanism behind this flaw typically involves manipulating HTTP requests sent to specific endpoints within the WooCommerce plugin structure. These endpoints often handle AJAX calls or REST API interactions intended for administrative tasks. When these inputs are processed without verifying the session state, cookie authentication tokens, or nonce values that validate user permissions, the server executes the deletion command based solely on parameters provided by the client side. An attacker can craft a simple HTTP DELETE request targeting the specific review ID and submit it to the vulnerable endpoint from any external source. Because there is no check to confirm if the requester has elevated privileges, the system blindly complies with the instruction to delete the specified content. This lack of server-side validation allows for remote code execution in terms of data manipulation, enabling an adversary to alter the state of the application without prior access credentials.
The operational impact of this vulnerability is substantial and multifaceted, primarily affecting the trustworthiness and reputation management capabilities of online stores. Customer reviews serve as a primary social proof mechanism that influences purchasing decisions for potential buyers. By allowing arbitrary deletion of these reviews, an attacker can systematically erase negative feedback or, conversely, remove positive testimonials to damage the store's credibility. This capability facilitates defacement attacks where the visual presentation and informational integrity of the site are compromised without necessarily gaining full control over the server infrastructure. Furthermore, such actions disrupt business operations by requiring manual restoration of data from backups if available, leading to potential downtime and loss of customer confidence. The ability to silently alter content also poses a risk for legal compliance issues in jurisdictions where retaining accurate transaction records or consumer feedback is mandated.
Mitigation strategies must focus on immediate remediation through software updates and enhanced security configurations. The most effective solution is to upgrade the WooCommerce plugin to version 5.120.1 or later, where developers have implemented stricter access controls and validated all administrative actions against user permissions. For organizations unable to update immediately due to compatibility constraints with other plugins, temporary mitigations include restricting access to wp-admin directories via IP whitelisting using web application firewalls or server-level configurations like .htaccess rules. Additionally, implementing robust input validation on any custom code that interacts with review data can help prevent exploitation of similar logic flaws in third-party extensions. Regular security audits and penetration testing should be conducted to identify other potential access control weaknesses within the WordPress ecosystem, ensuring a defense-in-depth approach that protects against both authenticated and unauthenticated threats.