CVE-2026-8615: WooCommerce Reviso Exporter Auth Bypass Flaw

CVE-2026-8615 Overview

CVE-2026-8615 affects the Reviso Exporter for WooCommerce plugin for WordPress in versions up to and including 1.2.3. The vulnerability results from a missing capability check and missing nonce verification in the disconnect_callback() function [CWE-862]. That function is registered to the wp_ajax_wcefr-disconnect AJAX action and unconditionally calls delete_option('wcefr-agt'), removing the Reviso Agreement Grant Token used to authenticate API calls. Authenticated attackers with Subscriber-level access or higher can invoke the endpoint and sever the integration between WooCommerce and the Reviso accounting service.

Critical Impact
Any authenticated user, including low-privilege Subscribers, can delete the plugin's stored Agreement Grant Token, breaking WooCommerce-to-Reviso synchronization until an administrator re-authenticates.

Affected Products

Reviso Exporter for WooCommerce plugin for WordPress, versions up to and including 1.2.3
Plugin slug wc-exporter-for-reviso distributed via the WordPress.org plugin repository
WordPress sites running the plugin with the Reviso integration configured

Discovery Timeline

2026-09-09 - CVE-2026-8615 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-8615

Vulnerability Analysis

The flaw is a classic missing authorization issue in a WordPress AJAX handler. The plugin registers disconnect_callback() against the wp_ajax_wcefr-disconnect action, which WordPress exposes to any authenticated user by default. The handler performs no capability check and no nonce verification before calling delete_option('wcefr-agt'). Because the wcefr-agt option stores the Reviso Agreement Grant Token used for outbound API authentication, its removal terminates the trust relationship between the WooCommerce store and the Reviso backend. Exploitation does not disclose data or allow code execution, but it does provide an integrity impact by disrupting an integration that store operators rely on for order and invoice export.

Root Cause

The disconnect_callback() function in includes/class-wcefr-settings.php (line 87 in tag 1.2.3) does not invoke check_ajax_referer() or current_user_can() before mutating persistent state. Any authenticated session, including a Subscriber, can therefore trigger the option deletion.

Attack Vector

An attacker with a valid WordPress account submits an AJAX POST request to /wp-admin/admin-ajax.php with action=wcefr-disconnect. WordPress dispatches the request to disconnect_callback(), which immediately deletes the wcefr-agt option. The action is repeatable and does not require user interaction from an administrator.

php

// Patch applied in release 1.2.4 - includes/class-wcefr-settings.php
public function disconnect_callback() {

    check_ajax_referer( 'wcefr-disconnect', 'nonce' );

    if ( ! current_user_can( 'manage_woocommerce' ) ) {
        wp_die( -1, 403 );
    }

    delete_option( 'wcefr-agt' );

    exit;
}

Source: GitHub commit 26ef890. The patch adds a nonce check and restricts execution to users holding the manage_woocommerce capability.

Detection Methods for CVE-2026-8615

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing action=wcefr-disconnect originating from non-administrator accounts.
Unexpected absence or repeated deletion of the wcefr-agt option in the WordPress wp_options table.
Reviso API calls from the affected site suddenly failing authentication after previously working.
WooCommerce administrators receiving prompts to re-authenticate the Reviso integration without having initiated a disconnect.

Detection Strategies

Enable WordPress request logging or a web application firewall rule that flags AJAX actions matching wcefr-disconnect from users below manage_woocommerce.
Correlate wp_options change events with the initiating user ID using a database audit plugin or server-side query logging.
Alert on Reviso API 401 or 403 responses that follow immediately after an admin-ajax.php POST.

Monitoring Recommendations

Track authenticated AJAX traffic segmented by user role to surface Subscriber-level requests hitting privileged actions.
Baseline the presence and value of the wcefr-agt option and alert on unauthorized deletion or modification.
Forward WordPress and web server logs to a centralized analytics platform to enable retroactive hunting for the wcefr-disconnect action string.

How to Mitigate CVE-2026-8615

Immediate Actions Required

Upgrade the Reviso Exporter for WooCommerce plugin to version 1.2.4 or later on every affected site.
Audit the WordPress user base and remove or downgrade unused Subscriber and higher accounts.
Rotate the Reviso Agreement Grant Token after patching to invalidate any credentials that may have been observed during exploitation attempts.

Patch Information

The vendor released version 1.2.4, which adds check_ajax_referer( 'wcefr-disconnect', 'nonce' ) and a current_user_can( 'manage_woocommerce' ) guard to disconnect_callback(). See the GitHub commit and the Wordfence vulnerability report for full details. Reference the vulnerable source at class-wcefr-settings.php line 87.

Workarounds

If patching is delayed, deactivate the Reviso Exporter for WooCommerce plugin until the update is applied.
Restrict access to /wp-admin/admin-ajax.php for the wcefr-disconnect action using a WAF rule that blocks requests from sessions lacking the manage_woocommerce capability.
Disable public user registration and enforce strong authentication to reduce the pool of accounts capable of triggering the endpoint.

bash

# Example WAF rule (ModSecurity) blocking the vulnerable AJAX action
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
    "chain,id:1026861500,phase:2,deny,status:403,\
    msg:'Block unauthenticated wcefr-disconnect AJAX call (CVE-2026-8615)'"
    SecRule ARGS:action "@streq wcefr-disconnect" \
        "chain"
        SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"