CVE-2026-100517
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The Photo Reviews for WooCommerce plugin in versions up to 1.2.30 contains an Insecure Direct Object References (IDOR) vulnerability exploitable by an unauthenticated attacker. Missing access controls allow access to objects the user should not be authorized to access.
Risk Assessment
An unauthenticated attacker may access other users' data or modify resources, potentially leading to confidentiality and integrity breaches.
Recommendation
Update the Photo Reviews for WooCommerce plugin to a version newer than 1.2.30. Until then, consider restricting access to review-related functionality.
Other vulnerabilities in Photo Reviews for WooCommerce
See all- CVE-2026-100515High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Reflected XSS.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.30.
- CVE-2026-101923High
The Photo Reviews for WooCommerce plugin for WordPress, up to version 1.2.30, is vulnerable to arbitrary content deletion. The plugin stores attacker-controlled post IDs in review comment meta without verifying ownership, and the deletion handler unconditionally deletes all stored IDs. This allows unauthenticated attackers to permanently delete arbitrary posts, pages, products, or media when an administrator deletes the review or when WordPress's cron empties the comment trash after 30 days.
Original NVD description (English source)
Unauthenticated Insecure Direct Object References (IDOR) in Photo Reviews for WooCommerce <= 1.2.30 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS