Skip to content
OpenAdvisories
High · 7.5 CVE-2026-100517 EUVD-2026-90843GHSA-h6mx-vr53-r68c

WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Insecure Direct Object References (IDOR) vulnerability

Published Oct 1, 2026 · Updated Oct 30, 2026 · Assigned by Patchstack

Description

Authorization Bypass Through User-Controlled Key vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.30.

Affected products

VendorProductAffectedFixed
VillaTheme Photo Reviews for WooCommerce ≤ 1.2.30 —

References