Vulnerabilities CVE-2026-12684

CVE-2026-12684

None

Open

TLP:CLEAR

Customer Reviews for WooCommerce < 5.113.0 - Unauthenticated Arbitrary Media Upload via cr_upload_media

NVD CVE.org

Critical Infrastructure

AI Analysis

No AI analysis yet.

Description

The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks on one of its media upload AJAX actions when the review media attachment feature is enabled, allowing unauthenticated users to upload media files (bounded to an image and video allowlist) to the Media Library and create attachment posts, leading to media library pollution and disk space exhaustion.

Details

EPSS Score ⓘ: 0.25%

16.4th percentile
Confidence: 90%
Published: Jul 16, 2026
Last Modified: Jul 16, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.