CVE-2026-110251
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized Media Library File Deletion in all versions up to, and including, 1.2.31. The delete_reviews_image() function trusts attachment IDs supplied via the wcpr_image_upload_id POST parameter stored in comment meta without ownership or capability checks, allowing unauthenticated attackers to permanently delete any WordPress media library attachment.
Risk Assessment
An attacker can delete any files from the WordPress media library, causing data loss and potential site disruption. This only requires a publicly available nonce, making the attack trivial.
Recommendation
Update the Photo Reviews for WooCommerce plugin to a version later than 1.2.31. Until then, consider disabling the plugin or restricting the ability to add reviews.
Other vulnerabilities in Photo Reviews for WooCommerce
See all- CVE-2026-111404Low
The Photo Reviews for WooCommerce plugin (up to version 1.2.31) contains a race condition vulnerability due to improper synchronization of shared resources. This may allow an attacker to exploit race conditions for unauthorized actions.
- CVE-2026-100161High
The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'wcpr_image_upload_id' parameter in versions up to and including 1.2.30. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts.
- CVE-2026-100515High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Reflected XSS.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.30.
- CVE-2026-101923High
The Photo Reviews for WooCommerce plugin for WordPress, up to version 1.2.30, is vulnerable to arbitrary content deletion. The plugin stores attacker-controlled post IDs in review comment meta without verifying ownership, and the deletion handler unconditionally deletes all stored IDs. This allows unauthenticated attackers to permanently delete arbitrary posts, pages, products, or media when an administrator deletes the review or when WordPress's cron empties the comment trash after 30 days.
- CVE-2026-100517High
The Photo Reviews for WooCommerce plugin (VillaTheme) through 1.2.30 contains an authorization bypass through a user-controlled key. This allows exploitation of incorrectly configured access control security levels.
Original NVD description (English source)
The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized Media Library File Deletion in all versions up to, and including, 1.2.31. This is due to the `delete_reviews_image()` function's `delete_comment` hook trusting attachment IDs supplied via the `wcpr_image_upload_id` POST parameter that were stored in comment meta without any ownership or capability check — `viwcpr_filter_review_image_ids()` verifies only that each submitted ID refers to an attachment post type, not that the submitter uploaded or owns it. This makes it possible for unauthenticated attackers to permanently delete any WordPress media library attachment — including its files on disk as recorded by `wp_delete_attachment()` — by embedding attacker-chosen attachment IDs into a review comment, then waiting for a moderator to remove the review or for WordPress core's `wp_scheduled_delete` cron to purge it after `EMPTY_TRASH_DAYS`. The nonce required to submit the parameter (`wcpr_image_upload`) is a shared public value printed on every product page for guest commenters and does not function as an authentication barrier, making this trivially exploitable without any account.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS