VillaTheme Photo Reviews for WooCommerce contains a race condition in its shared resource handling. The plugin does not enforce proper synchronization when several requests interact with the same data, leading to potential data corruption, inconsistent review counts, or a denial of service if the application fails or behaves unexpectedly. This flaw is classified as CWE-362.

Any WordPress site that has the VillaTheme Photo Reviews for WooCommerce plugin installed in a version up to and including 1.2.31 is affected. No specific operating system or PHP version is required for exploitation; the threat exists on standard WordPress deployments that enable the review feature.

The CVSS score of 3.7 indicates moderately serious consequences; the EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a concurrent request scenario on the review submission endpoint, inferred from the race condition description; an adversary could create multiple simultaneous submissions to manipulate review data or force a crash. Exploitation requires moderate skill, but the impact is limited to data integrity or availability rather than remote code execution.