CVE-2026-14941 Overview
CVE-2026-14941 is a missing authorization vulnerability [CWE-862] in the Customer Reviews for WooCommerce WordPress plugin. Versions before 5.116.0 fail to enforce nonce or capability checks on several settings-related AJAX actions. Authenticated users with minimal permissions, including the Subscriber role, can invoke administrative settings handlers. Attackers can update plugin options and disclose store configuration data without administrator privileges.
The issue affects any WordPress site running Customer Reviews for WooCommerce with open registration or exposed low-privilege accounts. The vulnerability is exploitable over the network with low attack complexity.
Critical Impact
Subscriber-level users can modify plugin settings and read store configuration, breaking the WordPress role-based access control model.
Affected Products
- Customer Reviews for WooCommerce WordPress plugin versions before 5.116.0
- WordPress installations running WooCommerce with this plugin enabled
- Sites that allow user registration or expose Subscriber-level accounts
Discovery Timeline
- 2026-08-10 - CVE-2026-14941 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-14941
Vulnerability Analysis
The Customer Reviews for WooCommerce plugin registers multiple AJAX endpoints tied to administrative settings. These handlers execute privileged operations such as reading and writing plugin options through the WordPress admin-ajax.php interface. The plugin registers these callbacks using the wp_ajax_ action hook, which is available to any authenticated user regardless of role.
The handlers omit two critical checks. First, they do not verify a WordPress nonce via check_ajax_referer() or wp_verify_nonce(). Second, they do not enforce capability validation via current_user_can('manage_options') or a similar check. Any logged-in user, including Subscribers, can invoke the endpoints and trigger the underlying settings logic.
Root Cause
The root cause is missing authorization [CWE-862] on privileged AJAX action handlers. The plugin trusts authenticated session context without validating that the acting user holds the capability required to modify settings. This violates the WordPress security model, which requires each privileged handler to independently verify both intent (nonce) and permission (capability).
Attack Vector
An attacker registers or authenticates as a Subscriber-level user on the target WordPress site. The attacker then sends crafted POST requests to /wp-admin/admin-ajax.php invoking the affected plugin actions. Because no nonce or capability check is performed, the server executes the settings handlers with administrator-equivalent effect. The attacker can alter plugin options controlling review moderation, third-party integrations, and store display behavior, and can read configuration values back through response data.
See the WPScan Vulnerability Report for further technical detail.
Detection Methods for CVE-2026-14941
Indicators of Compromise
- Unexpected POST requests to /wp-admin/admin-ajax.php from accounts with Subscriber or Customer roles
- Modification of Customer Reviews for WooCommerce plugin options without a corresponding administrator session
- New or recently registered low-privilege accounts issuing AJAX traffic to plugin-specific action names
Detection Strategies
- Audit WordPress access logs for admin-ajax.php requests where the action parameter targets Customer Reviews for WooCommerce handlers and the authenticated user is not an administrator
- Enable WordPress option-change auditing to record every write to the wp_options table and correlate changes with the acting user ID
- Inspect the plugin version reported by WordPress and flag any instance older than 5.116.0
Monitoring Recommendations
- Alert on settings changes to Customer Reviews for WooCommerce options performed by non-administrator users
- Monitor for spikes in Subscriber-authenticated AJAX activity, which typically indicates automation against admin endpoints
- Track new user registrations followed within minutes by AJAX calls to plugin action names
How to Mitigate CVE-2026-14941
Immediate Actions Required
- Update Customer Reviews for WooCommerce to version 5.116.0 or later on every affected site
- Review the plugin option values in wp_options and restore known-good settings if tampering is suspected
- Audit user accounts and remove untrusted Subscriber or Customer registrations created before the patch was applied
Patch Information
The vendor addressed CVE-2026-14941 in Customer Reviews for WooCommerce version 5.116.0. The fix adds nonce verification and capability checks to the affected AJAX handlers. Site operators should upgrade through the WordPress plugin updater or by deploying the patched release from the official plugin repository. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Disable the Customer Reviews for WooCommerce plugin until the update is applied
- Restrict new user registration by setting Anyone can register to disabled under WordPress general settings
- Deploy a Web Application Firewall rule to block admin-ajax.php requests to the affected plugin action names from non-administrator sessions
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
