CVE-2026-111404
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Photo Reviews for WooCommerce plugin (up to version 1.2.31) contains a race condition vulnerability due to improper synchronization of shared resources. This may allow an attacker to exploit race conditions for unauthorized actions.
Risk Assessment
The vulnerability could enable an attacker to manipulate shared resources and potentially affect data integrity or application availability. Organizations using this plugin are exposed to exploitation.
Recommendation
Update the Photo Reviews for WooCommerce plugin to the latest version that includes the fix. If updating is not possible, consider disabling the plugin until the patch is applied.
Other vulnerabilities in Photo Reviews for WooCommerce
See all- CVE-2026-110251Medium
The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized Media Library File Deletion in all versions up to, and including, 1.2.31. The delete_reviews_image() function trusts attachment IDs supplied via the wcpr_image_upload_id POST parameter stored in comment meta without ownership or capability checks, allowing unauthenticated attackers to permanently delete any WordPress media library attachment.
- CVE-2026-100161High
The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'wcpr_image_upload_id' parameter in versions up to and including 1.2.30. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts.
- CVE-2026-100515High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Reflected XSS.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.30.
- CVE-2026-101923High
The Photo Reviews for WooCommerce plugin for WordPress, up to version 1.2.30, is vulnerable to arbitrary content deletion. The plugin stores attacker-controlled post IDs in review comment meta without verifying ownership, and the deletion handler unconditionally deletes all stored IDs. This allows unauthenticated attackers to permanently delete arbitrary posts, pages, products, or media when an administrator deletes the review or when WordPress's cron empties the comment trash after 30 days.
- CVE-2026-100517High
The Photo Reviews for WooCommerce plugin (VillaTheme) through 1.2.30 contains an authorization bypass through a user-controlled key. This allows exploitation of incorrectly configured access control security levels.
Original NVD description (English source)
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Leveraging Race Conditions.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.31.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS