Arbitrary Content Deletion Vulnerability in WooCommerce Photo Reviews Plugin by WordPress

CVE-2026-101923

What is CVE-2026-101923?

The Photo Reviews for WooCommerce plugin for WordPress suffers from a vulnerability that allows attackers to delete arbitrary posts, pages, products, or media attachments. This is facilitated by the plugin's handling of the wcpr_image_upload_id parameter during public review submissions, where it mistakenly trusts attacker-controlled post IDs without proper validation. When a review is removed by an administrator, the plugin's delete_reviews_image() function recklessly executes the wp_delete_post() call for those IDs, enabling potential unauthorized content deletion whenever the review is deleted, particularly after scheduled comment trash empties.

References