Executive brief
The Reviso Exporter for WooCommerce is a WordPress plugin that integrates WooCommerce with the Reviso accounting service. A flaw in the plugin's disconnect function allows any authenticated user with basic access to delete the stored authentication token, severing the connection between WooCommerce and Reviso and potentially disrupting order synchronization and accounting operations.
Technical details
The vulnerability is a missing capability check and nonce verification in the disconnect_callback() AJAX function (registered as 'wp_ajax_wcefr-disconnect'). The function unconditionally calls delete_option('wcefr-agt'), removing the Reviso Agreement Grant Token, with no checks to verify the caller has the required 'manage_woocommerce' capability. This allows any authenticated user at Subscriber level or above to invoke the AJAX action and delete the token. An attacker must be authenticated to the WordPress site but requires no administrative privileges. The fix, released in version 1.2.4, adds both capability checks and nonce verification to the disconnect_callback() function.
Affected products
- ilGhera Reviso Exporter for WooCommerce up to and including 1.2.3
Timeline
- 2026-09-09: disclosed
- 2026-09-09: patched: Version 1.2.4 released with capability check and nonce verification added