Unauthorized Data Modification in Reviso Exporter for WooCommerce Plugin by WordPress

CVE-2026-8615

What is CVE-2026-8615?

The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauthorized data modification due to a lack of capability checks and nonce verifications in the disconnect_callback() function. This function, linked to the 'wp_ajax_wcefr-disconnect' AJAX action, can be exploited by authenticated users with Subscriber-level access or higher. The vulnerability allows these attackers to delete the Agreement Grant Token by invoking delete_option('wcefr-agt'), which effectively severs the connection between WooCommerce and the Reviso API. The absence of proper verification mechanisms poses a significant risk for data integrity within the affected plugin.

References