# CVE-2026-14941: Customer Reviews for WooCommerce missing authorization checks in AJAX handlers

Source: https://junglewise.ai/threats/cve-2026-14941-customer-reviews-for-woocommerce-missing-authorization-checks-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-14941 · Severity: medium · CVSS 5.4 · Published 2026-08-10

The Customer Reviews for WooCommerce WordPress plugin fails to properly verify user permissions on several administrative settings functions. This allows low-privileged users, such as subscribers or customers, to change plugin configuration, modify email sender settings, and read sensitive store configuration details—potentially enabling email spoofing and information disclosure about the online store.

## Quick answers

**Is CVE-2026-14941 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14941 being exploited in the wild.

**How severe is CVE-2026-14941?** Medium severity, with a CVSS score of 5.4, published 10 August 2026.

**Which products and versions are affected?** WP Evotech Customer Reviews for WooCommerce before 5.116.0.

**Is there a fix for CVE-2026-14941?** A patch was published on 2026-08-10: Fixed in version 5.116.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-14941 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-14941?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The plugin does not perform nonce or capability checks on multiple AJAX actions (cr_settings_hide_banner, ivole_check_license_email_ajax, cr_verify_email_ajax, cr_verify_dkim_ajax, ivole_check_license_ajax, cr_check_age_restriction_ajax), allowing any authenticated user with Subscriber-level permissions to invoke administrative handlers. An attacker with a Subscriber or customer account can update the ivole_hidden_banners option, modify the ivole_email_from setting, and retrieve sensitive store configuration including license state, sender email, and sender name via AJAX POST requests. The vulnerability requires authentication (WordPress session cookie) but no additional CSRF protection or permission validation. The plugin was patched in version 5.116.0, where all affected actions now properly check capabilities and reject unauthorized access.

## Affected products

- WP Evotech Customer Reviews for WooCommerce before 5.116.0

## Timeline

- 2026-08-06: disclosed
- 2026-08-10: patched: Fixed in version 5.116.0

## References

- [https://wpscan.com/vulnerability/572ba4a2-1b51-4631-9c28-7cc3d44f0761/](https://wpscan.com/vulnerability/572ba4a2-1b51-4631-9c28-7cc3d44f0761/)