Live › vulnerability › CVE-2026-110251
The Photo Reviews for WooCommerce plugin for WordPress, in all versions up to and including 1.2.31, trusts attachment IDs submitted with review comments without checking ownership. An unauthenticated attacker can get any media library attachment, and its file on disk, permanently deleted once a review is removed or trash is emptied.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 07:34 UTC. All times on this page are UTC.
Any WooCommerce store running the Photo Reviews for WooCommerce plugin at version 1.2.31 or earlier, where customers can submit review images. The flaw needs no account, because the nonce it checks is public on every product page for guest commenters. Sites without this plugin, or with it at a newer version, are not affected.
No product ranges from the sources yet.
wp plugin get photo-reviews-for-woocommerce --field=version if WP-CLI is available), and see whether it is 1.2.31 or earlier.1.2.31 once the vendor publishes one.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized Media Library File Deletion in all versions up to, and including, 1.2.31. This is due to the delete_reviews_image() function's delete_comment hook trusting attachment IDs supplied via the wcpr_image_upload_id POST parameter that were stored in comment meta without any ownership or capability check — viwcpr_filter_review_image_ids() verifies only that each submitted ID refers to an attachment post type, not that the submitter uploaded or owns it. This makes it possible for unauthenticated attackers to permanently delete any WordPress media library attachment — including its files on disk as recorded by wp_delete_attachment() — by embedding attacker-chosen attachment IDs into a review comment, then waiting for a moderator to remove the review or for WordPress core's wp_scheduled_delete cron to purge it after EMPTY_TRASH_DAYS. The nonce required to submit the parameter (wcpr_image_upload) is a shared public value printed on every product page for guest commenters and does not function as an authentication barrier, making this trivially exploitable without any account.
This page as .md · .json · in your agent: get_signal("CVE-2026-110251")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.