Skip to content
OpenAdvisories
Medium · 6.5 Public exploit CVE-2026-12684 EUVD-2026-44877GHSA-22m6-qpwv-v2xp

Customer Reviews for WooCommerce < 5.113.0 - Unauthenticated Arbitrary Media Upload via cr_upload_media

Published Jul 16, 2026 · Updated Jul 16, 2026 · Assigned by WPScan

Category: Web / CMS

Description

The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks on one of its media upload AJAX actions when the review media attachment feature is enabled, allowing unauthenticated users to upload media files (bounded to an image and video allowlist) to the Media Library and create attachment posts, leading to media library pollution and disk space exhaustion.

Affected products

VendorProductAffectedFixed
— Customer Reviews for WooCommerce < 5.113.0 5.113.0

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • htrxuan/hdwebmobile-photo-video-reviews ★ 0 · Aug 26, 2026

    WooCommerce plugin: photo & video product reviews, closing CVE-2026-12684's unauthenticated-upload vulnerability class by construction

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References