CVE-2026-121518: Customer Reviews for WooCommerce <= 5.127.0 - Unauthenticated Sensitive Information Exposure in 'search' Parameter
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 5.127.0 via the 'search' parameter of the crshowmoreallreviews and crshowmorereviews AJAX actions. This is due to the handlers being hooked on wpajaxnopriv without a capability check (and, in the product-page handler, with a nonce check that is behind a filter defaulting to false) while passing the visitor-supplied search string straight into getcomments() as the 'search' argument, which core expands into LIKE conditions over commentauthor, commentauthoremail, commentauthorurl, commentauthorIP and commentcontent. This makes it possible for unauthenticated attackers to extract review author email addresses and IP addresses — fields WordPress and WooCommerce never expose to the public — one character at a time by observing whether the returned result set matches a probed substring.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote visitor can probe the affected AJAX actions. No WordPress account, elevated capability, or user interaction is required.
What information can be exposed?
An attacker can infer review author email addresses and IP addresses by testing search substrings and observing whether matching reviews are returned. The affected search behavior also queries author names, URLs, and review content.
Are both review-loading AJAX handlers affected in the same way?
Both cr_show_more_all_reviews and cr_show_more_reviews accept the visitor-controlled search value. The product-page handler has a nonce check, but it is behind a filter whose default is false, so it does not provide protection by default.
How can I determine whether my site is affected?
A site is affected if it uses Customer Reviews for WooCommerce version 5.127.0 or earlier. The relevant exposure is reachable through the plugin's unauthenticated review-loading AJAX actions.