CVE-2026-111404: WordPress Photo Reviews for WooCommerce plugin <= 1.2.31 - Race Condition vulnerability
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Leveraging Race Conditions.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.31.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Photo Reviews for WooCommerceto a version that resolves this vulnerability.Fixed in 1.2.32
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The CVSS vector indicates that exploitation can be performed over the network without prior privileges or user interaction. However, the attack complexity is high, meaning successful exploitation depends on winning a timing-related race condition.
What is the security impact if exploitation succeeds?
The reported impact is limited to integrity: an attacker may be able to cause unauthorized modification. No confidentiality disclosure or availability impact is indicated by the provided CVSS vector.
Which plugin versions are affected?
Photo Reviews for WooCommerce versions through 1.2.31 are affected. The provided information does not identify a fixed version.