{"id":"CVE-2026-110251","kind":"vulnerability","aliases":["CVE-2026-110251"],"related":[],"title":"WordPress Photo Reviews plugin lets anyone delete media library files","description":"The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized Media Library File Deletion in all versions up to, and including, 1.2.31. This is due to the `delete_reviews_image()` function's `delete_comment` hook trusting attachment IDs supplied via the `wcpr_image_upload_id` POST parameter that were stored in comment meta without any ownership or capability check — `viwcpr_filter_review_image_ids()` verifies only that each submitted ID refers to an attachment post type, not that the submitter uploaded or owns it. This makes it possible for unauthenticated attackers to permanently delete any WordPress media library attachment — including its files on disk as recorded by `wp_delete_attachment()` — by embedding attacker-chosen attachment IDs into a review comment, then waiting for a moderator to remove the review or for WordPress core's `wp_scheduled_delete` cron to purge it after `EMPTY_TRASH_DAYS`. The nonce required to submit the parameter (`wcpr_image_upload`) is a shared public value printed on every product page for guest commenters and does not function as an authentication barrier, making this trivially exploitable without any account.","summary":"The Photo Reviews for WooCommerce plugin for WordPress, in all versions up to and including 1.2.31, trusts attachment IDs submitted with review comments without checking ownership. An unauthenticated attacker can get any media library attachment, and its file on disk, permanently deleted once a review is removed or trash is emptied.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","photo-reviews-for-woocommerce","self-hosted","woocommerce","wordpress"],"not_affected_if":["newer-version","plugin-not-installed"],"how_to_check":"- Check the installed version of the Photo Reviews for WooCommerce plugin (`wp plugin get photo-reviews-for-woocommerce --field=version` if WP-CLI is available), and see whether it is `1.2.31` or earlier.\n- Confirm the plugin is active on the site under Plugins in the WordPress admin.","fix":"- Photo Reviews for WooCommerce: a fixed version is not stated in the sources; move to a release newer than `1.2.31` once the vendor publishes one.","status":"open","published_at":"2026-10-31T07:16:34+00:00","first_seen_at":"2026-10-31T07:34:07+00:00","triaged_at":"2026-10-31T07:34:47+00:00","updated_at":"2026-10-31T07:34:47+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-31T07:34:47Z","model":"claude-haiku-5-5","output":{"fix":"- Photo Reviews for WooCommerce: a fixed version is not stated in the sources; move to a release newer than `1.2.31` once the vendor publishes one.","reach":"internet","title":"WordPress Photo Reviews plugin lets anyone delete media library files","impact":"medium","summary":"The Photo Reviews for WooCommerce plugin for WordPress, in all versions up to and including 1.2.31, trusts attachment IDs submitted with review comments without checking ownership. An unauthenticated attacker can get any media library attachment, and its file on disk, permanently deleted once a review is removed or trash is emptied.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","photo-reviews-for-woocommerce","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Media library files and attachments are permanently deleted from the site.","analyst_note":"Confirm the fixed version and vendor advisory at the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-110251; the sources do not name a patched release.","how_to_check":"- Check the installed version of the Photo Reviews for WooCommerce plugin (`wp plugin get photo-reviews-for-woocommerce --field=version` if WP-CLI is available), and see whether it is `1.2.31` or earlier.\n- Confirm the plugin is active on the site under Plugins in the WordPress admin.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","newer-version"],"who_is_affected":"Any WooCommerce store running the Photo Reviews for WooCommerce plugin at version 1.2.31 or earlier, where customers can submit review images. The flaw needs no account, because the nonce it checks is public on every product page for guest commenters. Sites without this plugin, or with it at a newer version, are not affected.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000799,"input_tokens":4435,"output_tokens":711,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110251':13A,16A '-2026':12A,15A '1.2.31':43B,102C 'account':264C 'anyon':6A 'attach':45B,62B,117C,154C,179C,190C,196C 'attack':56B,171C,194C 'attacker-chosen':193C 'authent':256C 'barrier':257C 'capabl':138C 'check':52B,139C 'chosen':195C 'comment':50B,114C,132C,201C,249C 'core':214C 'cron':219C 'cve':11A,14A 'day':226C 'delet':7A,69B,94C,108C,113C,174C,189C,218C 'disk':67B,184C 'due':105C 'embed':192C 'empti':78B,224C 'everi':244C 'exploit':261C 'file':10A,65B,93C,182C 'filter':141C 'function':111C,253C 'get':58B 'guest':248C 'hook':115C 'host':25B 'id':46B,118C,125C,144C,150C,197C 'imag':110C,123C,143C,235C 'includ':42B,101C,180C 'let':5A 'librari':9A,61B,92C,178C 'make':166C,258C 'media':8A,60B,91C,177C 'meta':133C 'moder':206C 'nonc':228C 'own':163C 'ownership':53B,136C 'packag':17B 'page':246C 'paramet':127C,233C 'perman':68B,173C 'photo':2A,19B,29B,80C 'photo-reviews-for-woocommerc':18B 'plugin':4A,33B,84C 'possibl':168C 'post':126C,155C 'print':242C 'product':245C 'public':240C 'purg':221C 'record':186C 'refer':151C 'remov':74B,208C 'requir':229C 'review':3A,20B,30B,49B,72B,81C,109C,142C,200C,210C 'schedul':217C 'self':24B 'self-host':23B 'share':239C 'store':130C 'submit':47B,149C,231C 'submitt':160C 'suppli':119C 'trash':76B,225C 'trivial':260C 'trust':44B,116C 'type':156C 'unauthent':55B,170C 'unauthor':90C 'upload':124C,161C,236C 'valu':241C 'verifi':145C 'version':38B,97C 'via':120C 'viwcpr':140C 'vulner':88C 'wait':203C 'wcpr':122C,234C 'without':51B,134C,262C 'woocommerc':22B,26B,32B,83C 'wordpress':1A,27B,35B,86C,176C,213C 'wp':188C,216C","nicknames":[],"mitigations":[],"who_affected":"Any WooCommerce store running the Photo Reviews for WooCommerce plugin at version 1.2.31 or earlier, where customers can submit review images. The flaw needs no account, because the nonce it checks is public on every product page for guest commenters. Sites without this plugin, or with it at a newer version, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T07:16:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110251","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110251","severity":null,"published_at":"2026-10-31T07:16:34+00:00","modified_at":"2026-10-31T07:16:34+00:00","first_seen_at":"2026-10-31T07:34:07+00:00","fetched_at":"2026-10-31T07:34:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}