CVE-2026-100517 Overview
CVE-2026-100517 is an unauthenticated Insecure Direct Object Reference (IDOR) vulnerability in the Photo Reviews for WooCommerce WordPress plugin. The flaw affects versions 1.2.30 and earlier. Attackers can reference internal objects without proper authorization checks, enabling manipulation of resources belonging to other users. The vulnerability is classified under CWE-639: Authorization Bypass Through User-Controlled Key and impacts system availability on affected WooCommerce stores.
Critical Impact
Remote, unauthenticated attackers can abuse direct object references over the network to disrupt availability of Photo Reviews for WooCommerce installations without any user interaction.
Affected Products
- Photo Reviews for WooCommerce plugin (woo-photo-reviews)
- Versions 1.2.30 and earlier
- WordPress sites running WooCommerce with the vulnerable plugin
Discovery Timeline
- 2026-10-01 - CVE-2026-100517 published to NVD
- 2026-10-01 - Last updated in NVD database
Technical Details for CVE-2026-100517
Vulnerability Analysis
The vulnerability resides in request handlers that accept object identifiers from client input without validating ownership or authorization. An unauthenticated attacker can submit crafted requests referencing arbitrary review or related object identifiers. The plugin processes the request using the attacker-supplied key and performs actions that should require authentication and ownership checks.
Because the attack vector is network-based and requires no privileges or user interaction, exploitation can be fully automated. The impact scope is limited to availability, meaning successful exploitation can disrupt or remove review-related data on the target store. Confidentiality and integrity are not directly impacted according to the published metrics.
The EPSS score sits at 0.3%, indicating low current exploitation probability, though public awareness of IDOR patterns in WordPress plugins frequently drives rapid tooling development after disclosure.
Root Cause
The root cause is missing authorization enforcement on object references. The plugin trusts user-supplied identifiers to locate and operate on records, without verifying that the requesting session owns or may act on the referenced object. This pattern aligns directly with [CWE-639].
Attack Vector
An attacker sends HTTP requests to the WordPress site hosting the vulnerable plugin. The requests include object identifiers chosen by the attacker. The plugin dispatches these to internal handlers that act on the referenced objects without checking authorization, enabling availability impact against resources owned by other users or the store itself.
No verified public exploit code is available at the time of writing. See the Patchstack advisory for Photo Reviews for WooCommerce for additional technical context.
Detection Methods for CVE-2026-100517
Indicators of Compromise
- Unauthenticated HTTP POST or GET requests to admin-ajax.php or REST endpoints exposed by the woo-photo-reviews plugin referencing sequential or enumerated identifiers.
- Unexpected deletion, modification, or state changes on review records without corresponding authenticated user sessions in access logs.
- Spikes in 200-OK responses from plugin endpoints originating from a single IP enumerating object IDs.
Detection Strategies
- Review web server access logs for request patterns targeting Photo Reviews for WooCommerce endpoints with varying numeric parameters from unauthenticated sources.
- Correlate WordPress database audit logs with HTTP request logs to identify unauthorized object manipulation.
- Deploy Web Application Firewall (WAF) rules that enforce authentication on plugin endpoints handling object identifiers.
Monitoring Recommendations
- Monitor plugin version inventory across managed WordPress sites and alert when woo-photo-reviews version is <= 1.2.30.
- Alert on high-frequency requests to WooCommerce review endpoints from a single source IP.
- Track anomalous changes in review counts or review-related tables that do not align with legitimate customer activity.
How to Mitigate CVE-2026-100517
Immediate Actions Required
- Identify all WordPress deployments running Photo Reviews for WooCommerce and determine the installed version.
- Update the plugin to a version later than 1.2.30 as soon as a vendor-released fix is available via the WordPress plugin repository.
- Restrict access to the WordPress site using IP allowlists or authentication proxies where feasible until patching completes.
Patch Information
Refer to the Patchstack advisory for current patch availability and vendor-released fixed versions. Apply the updated plugin through the WordPress admin dashboard or via WP-CLI once released.
Workarounds
- Deactivate the Photo Reviews for WooCommerce plugin until a patched release is installed if business operations permit.
- Deploy virtual patching rules via a WAF to block unauthenticated requests to vulnerable plugin endpoints.
- Enforce server-side authentication checks at the reverse proxy layer for admin-ajax.php actions associated with the plugin.
# Example: WP-CLI commands to inventory and disable the vulnerable plugin
wp plugin list --name=woo-photo-reviews --fields=name,status,version
wp plugin deactivate woo-photo-reviews
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
