# CVE-2026-89055: Customer Reviews for WooCommerce authorization bypass

Source: https://junglewise.ai/threats/cve-2026-89055-the-customer-reviews-for-woocommerce-plugin-for-wordpress-is  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-25. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-89055 · Severity: critical · CVSS 9.1 · Published 2026-09-25

The Customer Reviews for WooCommerce plugin fails to properly verify user permissions, allowing unauthenticated attackers to permanently delete media files from WordPress sites. An attacker can exploit a publicly-shared review form link to inject media attachment IDs and destroy critical assets like product images, logos, and documents when the review is deleted. No WordPress account is required—only access to the review form link that is typically distributed via email to customers.

Vendors: [WooCommerce](https://junglewise.ai/threats/vendors/woocommerce).

## Quick answers

**Is CVE-2026-89055 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-89055 being exploited in the wild.

**How severe is CVE-2026-89055?** Critical severity, with a CVSS score of 9.1, published 25 September 2026.

**Which products and versions are affected?** WooCommerce Customer Reviews for WooCommerce up to and including 5.120.0.

**Is there a fix for CVE-2026-89055?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-89055 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-89055?** Check whether you run WooCommerce Customer Reviews for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authorization bypass exists in the plugin's review form handler due to insufficient permission checks. The vulnerability allows unauthenticated attackers to supply arbitrary media attachment IDs in review data, which are then deleted when the review is trashed and purged; the nonce validation passes because it is exposed in the publicly-shared review form link (a 13-character hex formId). The attack surface is the plugin's AJAX endpoints in class-cr-local-forms-ajax.php and class-cr-endpoint.php, exploitable without any WordPress session or credentials.

## Affected products

- Woocommerce Customer Reviews for WooCommerce up to and including 5.120.0

## Timeline

- 2026-09-25: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.120.0/includes/reminders/class-cr-local-forms-ajax.php](https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.120.0/includes/reminders/class-cr-local-forms-ajax.php)
- [https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.120.0/includes/reviews/class-cr-endpoint.php](https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.120.0/includes/reviews/class-cr-endpoint.php)