Sensitive Information Exposure in Customer Reviews Plugin for WooCommerce by WordPress

CVE-2026-121518

What is CVE-2026-121518?

The Customer Reviews for WooCommerce plugin for WordPress is susceptible to a significant vulnerability that permits the exposure of sensitive information. Specifically, the issue arises from inadequate security checks on AJAX handlers for three actions, which allows attackers to utilize the 'search' parameter. Consequently, unauthenticated users may exploit this vulnerability by observing the returned result set from the 'search' queries. This could lead to the extraction of sensitive data, such as review authors' email addresses, IP addresses, and other fields that are typically protected within the WordPress and WooCommerce ecosystems. As a result, enforcing capability checks and mitigating direct exposure through proper validation measures is crucial to safeguarding user data.

References