CVE-2026-12684: Customer Reviews for WooCommerce < 5.113.0 - Unauthenticated Arbitrary Media Upload via cr_upload_media
The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks on one of its media upload AJAX actions when the review media attachment feature is enabled, allowing unauthenticated users to upload media files (bounded to an image and video allowlist) to the Media Library and create attachment posts, leading to media library pollution and disk space exhaustion.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress/WooCommerce (Customer Reviews for WooCommerce)to a version that resolves this vulnerability.Fixed in 5.113.0 - Compensating control
Ensure the 'review media attachment' feature in the Customer Reviews for WooCommerce WordPress plugin is disabled until the plugin is upgraded, to prevent unauthenticated media upload via the cr_upload_media AJAX action.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12684?
CVE-2026-12684 has a risk rating of 45, indicating a moderate severity level.
How do I fix CVE-2026-12684?
To fix CVE-2026-12684, update the Customer Reviews for WooCommerce plugin to version 5.113.0 or higher.
What does CVE-2026-12684 exploit in the Customer Reviews for WooCommerce plugin?
CVE-2026-12684 exploits the lack of authentication, capability, or nonce checks on the media upload AJAX action.
What type of attack does CVE-2026-12684 allow?
CVE-2026-12684 allows unauthenticated users to upload arbitrary media files, potentially leading to malicious file uploads.
Which versions of the Customer Reviews for WooCommerce plugin are affected by CVE-2026-12684?
All versions of the Customer Reviews for WooCommerce plugin prior to 5.113.0 are affected by CVE-2026-12684.