{"id":"CVE-2026-121518","kind":"vulnerability","aliases":["CVE-2026-121518"],"related":[],"title":"WordPress WooCommerce reviews plugin leaks reviewer emails and IP addresses","description":"The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 5.127.0 via the 'search' parameter of the cr_show_more_all_reviews and cr_show_more_reviews AJAX actions. This is due to the handlers being hooked on wp_ajax_nopriv_* without a capability check (and, in the product-page handler, with a nonce check that is behind a filter defaulting to false) while passing the visitor-supplied search string straight into get_comments() as the 'search' argument, which core expands into LIKE conditions over comment_author, comment_author_email, comment_author_url, comment_author_IP and comment_content. This makes it possible for unauthenticated attackers to extract review author email addresses and IP addresses — fields WordPress and WooCommerce never expose to the public — one character at a time by observing whether the returned result set matches a probed substring.","summary":"The Customer Reviews for WooCommerce plugin lets anyone without a login search review comments through its AJAX handlers. An attacker can use that search to recover reviewers' email addresses and IP addresses one character at a time.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","woocommerce","wordpress"],"not_affected_if":["newer-version","plugin-not-installed"],"how_to_check":"- Check whether the plugin is installed and its version in WordPress admin under Plugins, or with `wp plugin get customer-reviews-woocommerce --field=version`\n- Look for the plugin's `cr_show_more_reviews` and `cr_show_more_all_reviews` AJAX actions in the plugin code","fix":"- Customer Reviews for WooCommerce: versions after `5.127.0` (the vulnerable range is up to and including `5.127.0`; the fixed version is not stated in the sources)","status":"open","published_at":"2026-11-13T10:17:27+00:00","first_seen_at":"2026-11-13T10:47:11+00:00","triaged_at":"2026-11-13T10:58:35+00:00","updated_at":"2026-11-13T10:58:35+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T10:58:35Z","model":"claude-haiku-5-5","output":{"fix":"- Customer Reviews for WooCommerce: versions after `5.127.0` (the vulnerable range is up to and including `5.127.0`; the fixed version is not stated in the sources)","reach":"internet","title":"WordPress WooCommerce reviews plugin leaks reviewer emails and IP addresses","impact":"medium","summary":"The Customer Reviews for WooCommerce plugin lets anyone without a login search review comments through its AJAX handlers. An attacker can use that search to recover reviewers' email addresses and IP addresses one character at a time.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"reviewer emails and IP addresses extracted by unauthenticated visitors","analyst_note":"Confirm the fixed version of Customer Reviews for WooCommerce from the vendor or WordPress plugin changelog; the sources give only the affected range.","how_to_check":"- Check whether the plugin is installed and its version in WordPress admin under Plugins, or with `wp plugin get customer-reviews-woocommerce --field=version`\n- Look for the plugin's `cr_show_more_reviews` and `cr_show_more_all_reviews` AJAX actions in the plugin code","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","newer-version"],"who_is_affected":"Any WordPress site running the Customer Reviews for WooCommerce plugin up to and including 5.127.0 is exposed, because the search parameter of its public review-loading AJAX actions is reachable without logging in. Sites that do not run this plugin, or that have updated past the affected range, are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000812,"input_tokens":4769,"output_tokens":670,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121518':13A,16A '-2026':12A,15A '5.127.0':80C 'action':98C 'address':10A,51B,54B,183C,186C 'ajax':39B,97C,109C 'anyon':30B 'argument':149C 'attack':42B,177C 'author':158C,160C,163C,166C,181C 'behind':128C 'capabl':113C 'charact':56B,197C 'check':114C,125C 'comment':36B,145C,157C,159C,162C,165C,169C 'condit':155C 'content':170C 'core':151C 'cr':87C,93C 'custom':24B,61C 'cve':11A,14A 'default':131C 'due':101C 'email':7A,50B,161C,182C 'expand':152C 'expos':192C 'exposur':73C 'extract':179C 'fals':133C 'field':187C 'filter':130C 'get':144C 'handler':40B,104C,121C 'hook':106C 'host':20B 'includ':79C 'inform':72C 'ip':9A,53B,167C,185C 'leak':5A 'let':29B 'like':154C 'login':33B 'make':172C 'match':208C 'never':191C 'nonc':124C 'nopriv':110C 'observ':202C 'one':55B,196C 'packag':17B 'page':120C 'paramet':84C 'pass':135C 'plugin':4A,28B,65C 'possibl':174C 'probe':210C 'product':119C 'product-pag':118C 'public':195C 'recov':48B 'result':206C 'return':205C 'review':3A,6A,25B,35B,49B,62C,91C,96C,180C 'search':34B,46B,83C,140C,148C 'self':19B 'self-host':18B 'sensit':71C 'set':207C 'show':88C,94C 'straight':142C 'string':141C 'substr':211C 'suppli':139C 'time':59B,200C 'unauthent':176C 'url':164C 'use':44B 'version':75C 'via':81C 'visitor':138C 'visitor-suppli':137C 'vulner':69C 'whether':203C 'without':31B,111C 'woocommerc':2A,21B,27B,64C,190C 'wordpress':1A,22B,67C,188C 'wp':108C","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running the Customer Reviews for WooCommerce plugin up to and including 5.127.0 is exposed, because the search parameter of its public review-loading AJAX actions is reachable without logging in. Sites that do not run this plugin, or that have updated past the affected range, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-121518':13A,16A '-2026':12A,15A 'address':10A 'cve':11A,14A 'email':7A 'ip':9A 'leak':5A 'plugin':4A 'review':3A,6A 'woocommerc':2A 'wordpress':1A","search_b":"'address':51B,54B 'ajax':39B 'anyon':30B 'attack':42B 'charact':56B 'comment':36B 'custom':24B 'email':50B 'handler':40B 'host':20B 'ip':53B 'let':29B 'login':33B 'one':55B 'packag':17B 'plugin':28B 'recov':48B 'review':25B,35B,49B 'search':34B,46B 'self':19B 'self-host':18B 'time':59B 'use':44B 'without':31B 'woocommerc':21B,27B 'wordpress':22B","search_c":"'5.127.0':80C 'action':98C 'address':183C,186C 'ajax':97C,109C 'argument':149C 'attack':177C 'author':158C,160C,163C,166C,181C 'behind':128C 'capabl':113C 'charact':197C 'check':114C,125C 'comment':145C,157C,159C,162C,165C,169C 'condit':155C 'content':170C 'core':151C 'cr':87C,93C 'custom':61C 'default':131C 'due':101C 'email':161C,182C 'expand':152C 'expos':192C 'exposur':73C 'extract':179C 'fals':133C 'field':187C 'filter':130C 'get':144C 'handler':104C,121C 'hook':106C 'includ':79C 'inform':72C 'ip':167C,185C 'like':154C 'make':172C 'match':208C 'never':191C 'nonc':124C 'nopriv':110C 'observ':202C 'one':196C 'page':120C 'paramet':84C 'pass':135C 'plugin':65C 'possibl':174C 'probe':210C 'product':119C 'product-pag':118C 'public':195C 'result':206C 'return':205C 'review':62C,91C,96C,180C 'search':83C,140C,148C 'sensit':71C 'set':207C 'show':88C,94C 'straight':142C 'string':141C 'substr':211C 'suppli':139C 'time':200C 'unauthent':176C 'url':164C 'version':75C 'via':81C 'visitor':138C 'visitor-suppli':137C 'vulner':69C 'whether':203C 'without':111C 'woocommerc':64C,190C 'wordpress':67C,188C 'wp':108C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T10:17:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121518","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121518","severity":null,"published_at":"2026-11-13T10:17:27+00:00","modified_at":"2026-11-13T10:17:27+00:00","first_seen_at":"2026-11-13T10:47:11+00:00","fetched_at":"2026-11-13T10:47:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}