CVE-2026-121518 · Package
NO FIX YET · SEE WHAT TO DO
The Customer Reviews for WooCommerce plugin lets anyone without a login search review comments through its AJAX handlers. An attacker can use that search to recover reviewers' email addresses and IP addresses one character at a time.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any WordPress site running the Customer Reviews for WooCommerce plugin up to and including 5.127.0 is exposed, because the search parameter of its public review-loading AJAX actions is reachable without logging in. Sites that do not run this plugin, or that have updated past the affected range, are not affected.
Not affected if newer-version, plugin-not-installed
Who cares self-hosted, woocommerce, wordpress
wp plugin get customer-reviews-woocommerce --field=versioncr_show_more_reviews and cr_show_more_all_reviews AJAX actions in the plugin code5.127.0 (the vulnerable range is up to and including 5.127.0; the fixed version is not stated in the sources)The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 5.127.0 via the 'search' parameter of the cr_show_more_all_reviews and cr_show_more_reviews AJAX actions. This is due to the handlers being hooked on wp_ajax_nopriv_* without a capability check (and, in the product-page handler, with a nonce check that is behind a filter defaulting to false) while passing the visitor-supplied search string straight into get_comments() as the 'search' argument, which core expands into LIKE conditions over comment_author, comment_author_email, comment_author_url, comment_author_IP and comment_content. This makes it possible for unauthenticated attackers to extract review author email addresses and IP addresses — fields WordPress and WooCommerce never expose to the public — one character at a time by observing whether the returned result set matches a probed substring.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.