Description
Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce <= 5.120.0 versions.
Published: 2026-09-30
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthenticated Arbitrary Content Deletion
Action: Immediate Patch
AI Analysis

Impact

The flaw allows an unauthenticated attacker to delete any content that the plugin handles, such as customer reviews, without needing proper authorization. This leads to loss of data integrity and can erode customer trust. The weakness is a missing authorization control (CWE-862).

Affected Systems

WordPress sites that have the CusRev Customer Reviews for WooCommerce plugin installed and running any version 5.120.0 or earlier.

Risk and Exploitability

The CVSS score of 7.5 classifies the vulnerability as high impact. No EPSS data is available, so the current probability of exploitation is unknown, and the issue is not listed in CISA KEV. Based on the description, the likely attack vector is through unauthenticated HTTP requests to the plugin’s content‑deletion endpoints, allowing an attacker to target any WordPress site hosting the affected plugin.

Generated by OpenCVE AI on September 30, 2026 at 16:36 UTC.

Remediation

Vendor Solution

Update the WordPress Customer Reviews for WooCommerce Plugin to the latest available version (at least 5.121.0).

OpenCVE Recommended Actions

  • Update the WordPress Customer Reviews for WooCommerce plugin to version 5.121.0 or later.
  • If an immediate update is not possible, temporarily disable the plugin to prevent exploitation.
  • Back up site data before applying the patch to ensure any accidental deletions can be restored.

Generated by OpenCVE AI on September 30, 2026 at 16:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 30 Sep 2026 13:00:00 +0000

Type Values Removed Values Added
Description Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce <= 5.120.0 versions.
Title WordPress Customer Reviews for WooCommerce plugin <= 5.120.0 - Arbitrary Content Deletion vulnerability
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-09-30T13:27:07.293Z

Reserved: 2026-09-23T17:30:22.498Z

Link: CVE-2026-96823

cve-icon Vulnrichment

Updated: 2026-09-30T13:19:02.455Z

cve-icon NVD

Status : Deferred

Published: 2026-09-30T13:17:31.917

Modified: 2026-09-30T14:18:11.420

Link: CVE-2026-96823

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T16:45:17Z

Weaknesses