Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce by Patchstack
CVE-2026-96823

7.5HIGH

Key Information:

Vendor

WordPress
Status
Customer Reviews For WooCommerce
Vendor
CVE Published:
30 September 2026

What is CVE-2026-96823?

A security flaw exists in the Customer Reviews for WooCommerce plugin that allows an unauthenticated user to delete arbitrary content from the plugin. This vulnerability affects versions up to 5.120.0 and poses a significant risk to the integrity of user reviews, potentially leading to information manipulation and loss of consumer trust.

Affected Version(s)

Customer Reviews for WooCommerce <= 5.120.0

References

https://patchstack.com/database/wordpress/plugin/customer...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Matheo Beuve | Patchstack Bug Bounty Program
.