A critical authorization bypass in the Customer Reviews for WooCommerce plugin for WordPress, versions up to and including 5.120.0, can let an attacker with no WordPress account permanently delete Media Library attachments. The attacker needs a valid review-form link to do this. The files are deleted only after the attacker's review is trashed and purged.
What Is It
CVE-2026-89055 is a missing authorization flaw (CWE-862) in the Customer Reviews for WooCommerce plugin by ivole. The plugin does not properly check that a user is authorized to perform an action. An attacker can inject attachment IDs into a review. When that review is later trashed and purged, the referenced attachments are permanently deleted from the Media Library.
To exploit it, the attacker needs a public review-form link. That link contains a 13-hex formId that is emailed to customers. The link exposes the nonce needed to reach the vulnerable handler, so no WordPress account or session is required.
Why It Matters
Wordfence scores this flaw 9.1 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H:
- Network-reachable with low attack complexity
- No privileges and no user interaction required
- High integrity and availability impact
The CVSS vector lists no privileges and no user interaction. In practice, two conditions have to be met first. The attacker must hold a valid review-form link, which is normally sent only to customers by email. The injected review must also be trashed and purged before any files are deleted. If both happen, the attachments at risk can include administrator-owned product images, logos, and documents. Losing them could break storefront pages and permanently remove site content.
The CISA KEV entry supplied for this CVE is empty, so the source data does not confirm active exploitation. NVD lists the record's status as "Deferred."
What's Vulnerable
- Vendor: ivole
- Product: Customer Reviews for WooCommerce (WordPress plugin)
- Affected versions: All versions from 0 up to and including 5.120.0
The Wordfence references point to the affected code in class-cr-local-forms-ajax.php, class-cr-endpoint.php, and class-cr-reviews.php in the 5.120.0 tag.
Patch Status
The supplied NVD record does not name a fixed version. It references a plugin changeset in the WordPress Trac repository, but the data does not say which release contains that change. There is no CISA KEV entry, so no federal required action or due date applies.
Administrators should check the Wordfence advisory and the plugin's WordPress.org page for a release later than 5.120.0 and update once one is confirmed. Until then, check reviews for unexpected attachment references before trashing and purging them, and keep an eye out for missing Media Library assets.