# CVE-2026-100517: Photo Reviews for WooCommerce insecure direct object references

Source: https://junglewise.ai/threats/cve-2026-100517-unauthenticated-insecure-direct-object-references-idor-in-photo  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-01. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-100517 · Severity: high · CVSS 7.5 · Published 2026-10-01

Photo Reviews for WooCommerce is a plugin that enables product review functionality for online stores built with WooCommerce. An unauthenticated attacker can bypass access controls to view and access other customers' photo reviews by manipulating object identifiers in requests, potentially exposing private review data and personal information associated with orders.

Vendors: [VillaTheme](https://junglewise.ai/threats/vendors/villatheme).

## Quick answers

**Is CVE-2026-100517 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100517 being exploited in the wild.

**How severe is CVE-2026-100517?** High severity, with a CVSS score of 7.5, published 1 October 2026.

**Which products and versions are affected?** VillaTheme Photo Reviews for WooCommerce up to 1.2.30.

**Is there a fix for CVE-2026-100517?** Yes: fixed in 1.2.31. Until then: Patchstack has issued a server-side mitigation rule that blocks requests exploiting this vulnerability. Enable this mitigation immediately if you cannot update to version 1.2.31 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-100517 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-100517?** Check whether you run VillaTheme Photo Reviews for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.2.31

Patchstack has issued a server-side mitigation rule that blocks requests exploiting this vulnerability. Enable this mitigation immediately if you cannot update to version 1.2.31 or later.

## Technical details

An insecure direct object references (IDOR) vulnerability in Photo Reviews for WooCommerce versions up to 1.2.30 allows unauthenticated attackers to access arbitrary photo reviews by directly referencing object IDs without proper authorization checks. The vulnerability requires only network access and no authentication, enabling an attacker to enumerate and retrieve sensitive review data belonging to other users. The issue has been fixed in version 1.2.31.

## Affected products

- VillaTheme Photo Reviews for WooCommerce up to 1.2.30

## Timeline

- 2026-10-01: disclosed
- 2026-10-01: advisory

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/woo-photo-reviews/vulnerability/wordpress-photo-reviews-for-woocommerce-plugin-1-2-30-insecure-direct-object-references-idor-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/woo-photo-reviews/vulnerability/wordpress-photo-reviews-for-woocommerce-plugin-1-2-30-insecure-direct-object-references-idor-vulnerability?_s_id=cve)

## Related threats

- [VillaTheme Photo Reviews for WooCommerce reflected XSS](https://junglewise.ai/threats/cve-2026-100515-improper-neutralization-of-input-during-web-page-generation)