CVE-2026-4664 PUBLISHED

Customer Reviews for WooCommerce <= 5.103.0 - Unauthenticated Authentication Bypass to Arbitrary Review Submission via 'key' Parameter

Assigner: Wordfence
Reserved: 23.03.2026 Published: 10.04.2026 Updated: 10.04.2026

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.103.0. This is due to the create_review_permissions_check() function comparing the user-supplied key parameter against the order's ivole_secret_key meta value using strict equality (===), without verifying that the stored key is non-empty. For orders where no review reminder email has been sent, the ivole_secret_key meta is not set, causing get_meta() to return an empty string. An attacker can supply key: "" to match this empty value and bypass the permission check. This makes it possible for unauthenticated attackers to submit, modify, and inject product reviews on any product — including products not associated with the referenced order — via the REST API endpoint POST /ivole/v1/review. Reviews are auto-approved by default since ivole_enable_moderation defaults to "no".

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS Score: 5.3

Product Status

Vendor ivole
Product Customer Reviews for WooCommerce
Versions Default: unaffected
  • affected from 0 to 5.103.0 (incl.)

Credits

  • Supanat Konprom finder

References

Problem Types

  • CWE-287 Improper Authentication CWE