The Customer Reviews for WooCommerce plugin before version 5.113.0 contains a flaw that allows unauthenticated users to call the cr_upload_media AJAX endpoint without performing authentication, capability, or nonce checks. The attacker can upload image and video files that pass a simple allow‑list, which creates new attachment posts in the WordPress Media Library. This results in media library pollution and the potential for disk space exhaustion, and can provide a foothold for additional attacks if other weaknesses exist. The weakness corresponds to CWE-434: Unrestricted upload of file.

Any WordPress site running the Customer Reviews for WooCommerce plugin with the review media attachment feature enabled and a version older than 5.113.0 is vulnerable.

The CVSS score of 6.5 indicates a moderate impact, and the EPSS score of less than 1% indicates a low likelihood of exploitation at the time of this analysis. Because it relies on an unrestricted file upload (CWE‑434), the attacker could exhaust storage and compromise site performance. The attacker’s vector is a simple unauthenticated HTTP request to the cr_upload_media endpoint, requiring no authentication or special privileges.