The Customer Reviews for WooCommerce plugin suffers from a missing authorization check that allows any requester to delete arbitrary attachments from the Media Library. The flaw is triggered via the items[][media] parameter in a review submission, enabling permanent removal of product images, logos, and other documents. This is a classic Missing Authorization weakness (CWE-862) that can undermine site integrity by erasing key media assets, but it does not grant code execution or broader system compromise.

WordPress sites running the ivole Customer Reviews for WooCommerce plugin, versions 5.120.0 or earlier. The issue exists in all releases up to and including 5.120.0. Affected sites expose review‑form links to customers, typically via email, which provide the necessary nonce to reach the deletion endpoint without an authenticated WordPress session.

The CVSS score of 9.1 indicates a very high risk. While the EPSS score is not available, the vulnerability can be easily exploited by any actor who obtains or guesses a valid public review‑form link, which is commonly distributed to customers. The exploit requires no privileged WordPress account; the attacker can supply any attachment ID to the endpoint to delete files permanently. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the lack of authentication makes it a prime target for automated attacks once a public form link is discovered.