This vulnerability arises from a missing authorization check in the qlohotelreview module’s AddReview AJAX action (a CWE‑639 vulnerability), allowing any attacker to submit hotel reviews without authentication. By supplying a valid review_ajax_token and an enumerated id_order, malicious actors can create fake ratings and reviews that are associated with existing customer orders. The impact is a partial compromise of data integrity and trust, enabling reputational damage and potential financial fraud by inflating or deflating reviews.

The issue affects QloApps versions 1.6.0 through 1.7.0. The affected product is the QloApps e‑commerce platform supplied by Webkul. Specific product names are QloApps and the qlohotelreview module. Version numbers are 1.6.0 up to and including 1.7.0; no later releases are listed as vulnerable in the data provided.

The CVSS score of 6.9 indicates medium severity, largely due to the lack of authentication requirement and the fact that the request is web‑accessible. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit this remotely by sending an AJAX request to the review endpoint with a known token and sequential order IDs, making the exploitation straightforward for anyone with web access to the site.