Customer Reviews for WooCommerce < 5.113.0 - Unauthenticated Arbitrary Media Upload via cr_upload_media
Priority LOW 35CWE-434Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-434.
Summary
The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks on one of its media upload AJAX actions when the review media attachment feature is enabled, allowing unauthenticated users to upload media files (bounded to an image and video allowlist) to the Media Library and create attachment posts, leading to media library pollution and disk space exhaustion.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00426 37th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Customer Reviews for WooCommerce (Unknown): 5.113.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Customer Reviews for WooCommerce | before 5.113.0 | 5.113.0 | Patch available | CNA |
- Customer Reviews for WooCommerce VendorUnknown Affected before 5.113.0 Fixed in 5.113.0 Patch available CNA
Remediation
- Fix · CNA Customer Reviews for WooCommerce (Unknown) Fixed in 5.113.0
Timeline
- 2026-10-02 Threatist record created from CVE-2026-12684
- 2026-10-03 Alias added: GHSA-22m6-qpwv-v2xp
References
Sources
- CVE-2026-12684 · CVE Program
- CVE-2026-12684 · NVD
- FIRST EPSS
- GHSA-22m6-qpwv-v2xp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences