CVE-2026-14941: Customer Reviews for WooCommerce < 5.116.0 - Subscriber+ Missing Authorization via Multiple Settings AJAX Actions
The Customer Reviews for WooCommerce WordPress plugin before 5.116.0 does not perform nonce or capability checks on several settings-related AJAX actions, allowing users with minimal permissions such as Subscribers to invoke administrative settings handlers, update Customer Reviews for WooCommerce WordPress plugin before 5.116.0 options, and disclose store configuration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: Customer Reviews for WooCommerceto a version that resolves this vulnerability.Fixed in 5.116.0 - Operational
After upgrading to Customer Reviews for WooCommerce WordPress plugin 5.116.0 or later, review and re-verify that Subscribers no longer can access or trigger administrative settings-related AJAX handlers and that store configuration disclosures from those endpoints are no longer possible.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14941?
CVE-2026-14941 has a risk rating of 52, indicating a moderate level of vulnerability.
How do I fix CVE-2026-14941?
To fix CVE-2026-14941, update the Customer Reviews for WooCommerce plugin to version 5.116.0 or higher.
What impact does CVE-2026-14941 have on my website?
CVE-2026-14941 allows users with minimal permissions, such as Subscribers, to access and modify administrative settings, potentially compromising your site.
Who is affected by CVE-2026-14941?
CVE-2026-14941 affects users of the Customer Reviews for WooCommerce plugin who have not updated to version 5.116.0 or later.
What versions of the Customer Reviews for WooCommerce plugin are vulnerable to CVE-2026-14941?
All versions of the Customer Reviews for WooCommerce plugin prior to 5.116.0 are vulnerable to CVE-2026-14941.