CVE-2026-101923 Overview
CVE-2026-101923 affects the Photo Reviews for WooCommerce plugin for WordPress in all versions up to and including 1.2.30. The plugin stores attacker-controlled post IDs supplied through the wcpr_image_upload_id parameter of a public review submission into the review's reviews-images comment meta without verifying that the IDs correspond to attachments owned by the submitter. When an administrator later deletes the attacker's review, the delete_reviews_image() handler calls wp_delete_post( $id, true ) on every stored ID, permanently removing the referenced content. Unauthenticated attackers can leverage this flaw to destroy arbitrary posts, pages, products, or media attachments.
Critical Impact
Unauthenticated attackers can permanently delete arbitrary WordPress content, including WooCommerce products and media, when an admin removes a malicious review or when wp_scheduled_delete empties the comment trash after 30 days.
Affected Products
- Photo Reviews for WooCommerce plugin for WordPress — versions <= 1.2.30
- WordPress sites running WooCommerce with the vulnerable plugin enabled
- Any content (posts, pages, products, media attachments) managed by the affected WordPress installation
Discovery Timeline
- 2026-10-03 - CVE-2026-101923 published to NVD
- 2026-10-06 - Last updated in NVD database
Technical Details for CVE-2026-101923
Vulnerability Analysis
The flaw is a Missing Authorization issue [CWE-862] in the review submission and deletion workflow. The plugin accepts the wcpr_image_upload_id parameter from unauthenticated users submitting photo reviews on the frontend. These IDs are intended to reference images uploaded by the reviewer, but the plugin never validates ownership, attachment type, or author association before persisting them to the reviews-images comment meta of the generated review.
When an administrator later deletes the review, the delete_reviews_image() handler iterates over every ID stored in that meta field and invokes wp_delete_post( $id, true ). The second argument forces permanent deletion, bypassing the trash. Because the IDs can reference any post object in the WordPress database, including published pages, WooCommerce products, and media attachments, the deletion is unbounded.
Exploitation requires user interaction from an administrator who deletes the malicious review. However, WordPress's built-in wp_scheduled_delete cron automatically empties trashed comments after 30 days, which triggers the same deletion path without manual admin action.
Root Cause
The plugin trusts attacker-supplied input to identify owned attachments and does not perform an authorization check comparing the submitted post IDs to the submitter's uploaded media. The deletion handler compounds the issue by unconditionally force-deleting whatever IDs it finds in comment meta.
Attack Vector
An unauthenticated attacker submits a crafted photo review containing arbitrary post IDs in wcpr_image_upload_id. The IDs are stored verbatim as review metadata. Deletion of the review, whether manual or via the scheduled trash purge, triggers the destruction of the referenced site content.
No verified exploitation code is published. See the Wordfence Vulnerability Analysis and the WordPress Plugin Frontend Code for technical details.
Detection Methods for CVE-2026-101923
Indicators of Compromise
- Pending or published photo reviews containing reviews-images comment meta entries that reference post IDs the reviewer did not upload.
- Unexpected deletions of WordPress posts, pages, WooCommerce products, or media attachments following review moderation or cron execution.
- Review submissions originating from unauthenticated sessions that include multiple wcpr_image_upload_id values targeting low-numbered or administrative post IDs.
Detection Strategies
- Audit the wp_commentmeta table for meta_key = 'reviews-images' entries and cross-reference the referenced post IDs against the attachment author to flag mismatches.
- Enable WordPress and WooCommerce audit logging to record every call to wp_delete_post with the originating user context and comment ID.
- Alert on HTTP POST requests to the plugin's review submission endpoint that include multiple numeric wcpr_image_upload_id values.
Monitoring Recommendations
- Monitor web server access logs for repeated review submissions from the same IP targeting the Photo Reviews for WooCommerce endpoint.
- Track scheduled WordPress cron events, specifically wp_scheduled_delete, and correlate them with subsequent content loss.
- Baseline the volume of pending reviews and alert on bulk comment trash operations by administrators.
How to Mitigate CVE-2026-101923
Immediate Actions Required
- Update the Photo Reviews for WooCommerce plugin to a version later than 1.2.30 that includes the fix referenced in the plugin changeset.
- Audit all pending and trashed reviews for suspicious reviews-images meta before approving or deleting them.
- Take a full database and media backup before performing any review moderation on sites still running vulnerable versions.
Patch Information
The vendor published a corrective changeset in the plugin's trunk. Review the WordPress Plugin Changeset Update and apply the patched release. Confirm the installed version is greater than 1.2.30 after upgrade.
Workarounds
- Disable the Photo Reviews for WooCommerce plugin until the patched release is deployed.
- Restrict review submission to authenticated customers and require manual review approval to limit exposure.
- Clear the comment trash manually after sanitizing reviews-images meta to prevent wp_scheduled_delete from triggering unintended deletions.
- Deploy a web application firewall rule that strips or rejects wcpr_image_upload_id values referencing post IDs the submitter does not own.
# Example: list suspicious reviews-images meta entries via WP-CLI
wp db query "SELECT comment_id, meta_value FROM wp_commentmeta WHERE meta_key='reviews-images';"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
