CVE-2026-101923
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
The Photo Reviews for WooCommerce plugin for WordPress, up to version 1.2.30, is vulnerable to arbitrary content deletion. The plugin stores attacker-controlled post IDs in review comment meta without verifying ownership, and the deletion handler unconditionally deletes all stored IDs. This allows unauthenticated attackers to permanently delete arbitrary posts, pages, products, or media when an administrator deletes the review or when WordPress's cron empties the comment trash after 30 days.
Risk Assessment
The organization may lose important content such as pages, products, or media irrecoverably, potentially causing store downtime and data loss.
Recommendation
Update the Photo Reviews for WooCommerce plugin to the latest patched version. If no patch is available, temporarily disable the plugin or restrict review submissions.
Other vulnerabilities in Photo Reviews for WooCommerce
See all- CVE-2026-110251Medium
The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized Media Library File Deletion in all versions up to, and including, 1.2.31. The delete_reviews_image() function trusts attachment IDs supplied via the wcpr_image_upload_id POST parameter stored in comment meta without ownership or capability checks, allowing unauthenticated attackers to permanently delete any WordPress media library attachment.
- CVE-2026-111404Low
The Photo Reviews for WooCommerce plugin (up to version 1.2.31) contains a race condition vulnerability due to improper synchronization of shared resources. This may allow an attacker to exploit race conditions for unauthorized actions.
- CVE-2026-100161High
The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'wcpr_image_upload_id' parameter in versions up to and including 1.2.30. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts.
- CVE-2026-100515High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Reflected XSS.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.30.
- CVE-2026-100517High
The Photo Reviews for WooCommerce plugin (VillaTheme) through 1.2.30 contains an authorization bypass through a user-controlled key. This allows exploitation of incorrectly configured access control security levels.
Original NVD description (English source)
The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Arbitrary Content Deletion in versions up to, and including, 1.2.30. This is due to the plugin storing attacker-controlled post IDs from the wcpr_image_upload_id parameter of a public review submission into the review's reviews-images comment meta without verifying that the IDs correspond to attachments owned by the submitter, combined with the delete_reviews_image() handler unconditionally calling wp_delete_post( $id, true ) on every stored ID when the review is deleted. This makes it possible for unauthenticated attackers to permanently delete arbitrary posts, pages, products, or media attachments on the site whenever an administrator subsequently deletes the attacker's review (or when WordPress's built-in wp_scheduled_delete cron empties the comment trash after 30 days).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS