The Customer Reviews for WooCommerce plugin contains an authentication bypass that allows an attacker to supply an empty key when sending a POST request to the review endpoint. The plugin compares the supplied key to the order’s secret key without checking that a key is present, and an unset key is an empty string. Because the check uses strict equality, the empty key matches and bypasses the permission test, permitting the creation, modification, or injection of product reviews. The default configuration auto‑approves reviews, so malicious content can appear on storefront pages immediately, compromising the integrity of product listings.

WordPress sites that run the Customer Reviews for WooCommerce plugin version 5.103.0 or earlier are vulnerable. Administrators should verify the plugin version and treat all reviews submitted since the plugin was installed as potentially unauthenticated until the plugin is updated.

The CVSS score of 5.3 indicates a moderate severity issue. The likely attack vector is an unauthenticated user sending a crafted POST request to the /ivole/v1/review REST endpoint. No special privileges or exploit code are required, and the vulnerability is trivially exploitable by anyone with network access to the site. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The consequence is loss of content integrity and potential reputation damage through spam or malicious reviews.