CVE-2026-101923
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
The Photo Reviews for WooCommerce plugin for WordPress, up to version 1.2.30, is vulnerable to arbitrary content deletion. The plugin stores attacker-controlled post IDs in review comment meta without verifying ownership, and the deletion handler unconditionally deletes all stored IDs. This allows unauthenticated attackers to permanently delete arbitrary posts, pages, products, or media when an administrator deletes the review or when WordPress's cron empties the comment trash after 30 days.
Risk Assessment
The organization may lose important content such as pages, products, or media irrecoverably, potentially causing store downtime and data loss.
Recommendation
Update the Photo Reviews for WooCommerce plugin to the latest patched version. If no patch is available, temporarily disable the plugin or restrict review submissions.
Other vulnerabilities in Photo Reviews for WooCommerce
See all- CVE-2026-100515High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Reflected XSS.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.30.
- CVE-2026-100517High
The Photo Reviews for WooCommerce plugin in versions up to 1.2.30 contains an Insecure Direct Object References (IDOR) vulnerability exploitable by an unauthenticated attacker. Missing access controls allow access to objects the user should not be authorized to access.
Original NVD description (English source)
The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Arbitrary Content Deletion in versions up to, and including, 1.2.30. This is due to the plugin storing attacker-controlled post IDs from the wcpr_image_upload_id parameter of a public review submission into the review's reviews-images comment meta without verifying that the IDs correspond to attachments owned by the submitter, combined with the delete_reviews_image() handler unconditionally calling wp_delete_post( $id, true ) on every stored ID when the review is deleted. This makes it possible for unauthenticated attackers to permanently delete arbitrary posts, pages, products, or media attachments on the site whenever an administrator subsequently deletes the attacker's review (or when WordPress's built-in wp_scheduled_delete cron empties the comment trash after 30 days).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS