Race Condition Vulnerability in VillaTheme Photo Reviews for WooCommerce
CVE-2026-111404

3.7LOW

Key Information:

Vendor

WordPress
Status
Photo Reviews For WooCommerce
Vendor
CVE Published:
26 October 2026

What is CVE-2026-111404?

The VillaTheme Photo Reviews for WooCommerce plugin has a vulnerability caused by improper synchronization when accessing shared resources. This can lead to race conditions, permitting unauthorized actions or data manipulation that could compromise the integrity of the application. Versions affected range from n/a up to 1.2.31, posing risks to users and their web assets.

Affected Version(s)

Photo Reviews for WooCommerce 0 <= 1.2.31

References

https://patchstack.com/database/wordpress/plugin/woo-phot...
vdb-entry

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Charles Vosburgh | Patchstack Bug Bounty Program
.