Junglewise Threat Intelligence

CVE-2026-4664: CusRev Customer Reviews for WooCommerce authentication bypass in REST API

CVE-2026-4664 · Severity: medium · CVSS 5.3 · Published 2026-04-10

Technologies: CusRev Customer Reviews for WooCommerce. Vendors: CusRev.

Executive brief

The Customer Reviews for WooCommerce plugin for WordPress, which automates customer feedback collection for online stores, contains a security flaw that allows unauthorized individuals to bypass authentication. By exploiting this vulnerability, an attacker can submit, modify, or inject fake product reviews on any product in the store. Because reviews are often set to be automatically approved, this could be used to damage a merchant's reputation or mislead customers with fraudulent feedback.

Technical details

The vulnerability exists in the `create_review_permissions_check()` function due to an improper comparison logic. The function uses strict equality (`===`) to compare a user-provided `key` against the `ivole_secret_key` order meta. However, for orders where a review reminder has not yet been sent, this meta value is not initialized, causing `get_meta()` to return an empty string. An attacker can provide an empty string as the `key` parameter to satisfy the condition and bypass the permission check. This allows unauthenticated POST requests to the `/ivole/v1/review` REST API endpoint to inject reviews into any product, regardless of whether it was part of the original order. The issue is addressed in version 5.104.0.

Affected products

  • CusRev Customer Reviews for WooCommerce up to, and including, 5.103.0

Timeline

  • 2026-04-09: disclosed: Reported by Wordfence
  • 2026-04-10: advisory: NVD publication date
  • 2026-04-24: other: NVD record last modified

References