---
id: "CVE-2026-121518"
page: "https://infrastack.ai/live/CVE-2026-121518"
kind: "vulnerability"
aliases: ["CVE-2026-121518"]
title: "WordPress WooCommerce reviews plugin leaks reviewer emails and IP addresses"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "woocommerce", "wordpress"]
not_affected_if: ["newer-version", "plugin-not-installed"]
published_at: "2026-11-13T10:17:27+00:00"
first_seen_at: "2026-11-13T10:47:11+00:00"
updated_at: "2026-11-13T10:58:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121518", "first_seen_at": "2026-11-13T10:47:11+00:00"}]
exploit_sources: []
---

# WordPress WooCommerce reviews plugin leaks reviewer emails and IP addresses

Link for people: https://infrastack.ai/live/CVE-2026-121518 (this .md is for agents)

The Customer Reviews for WooCommerce plugin lets anyone without a login search review comments through its AJAX handlers. An attacker can use that search to recover reviewers' email addresses and IP addresses one character at a time.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the plugin is installed and its version in WordPress admin under Plugins, or with `wp plugin get customer-reviews-woocommerce --field=version`
- Look for the plugin's `cr_show_more_reviews` and `cr_show_more_all_reviews` AJAX actions in the plugin code

## Fix

- Customer Reviews for WooCommerce: versions after `5.127.0` (the vulnerable range is up to and including `5.127.0`; the fixed version is not stated in the sources)

## Timeline

- 2026-11-13T10:47:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121518

## From the sources

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 5.127.0 via the 'search' parameter of the cr_show_more_all_reviews and cr_show_more_reviews AJAX actions. This is due to the handlers being hooked on wp_ajax_nopriv_* without a capability check (and, in the product-page handler, with a nonce check that is behind a filter defaulting to false) while passing the visitor-supplied search string straight into get_comments() as the 'search' argument, which core expands into LIKE conditions over comment_author, comment_author_email, comment_author_url, comment_author_IP and comment_content. This makes it possible for unauthenticated attackers to extract review author email addresses and IP addresses — fields WordPress and WooCommerce never expose to the public — one character at a time by observing whether the returned result set matches a probed substring.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_