Humbertosp

**Name of the Vulnerable Software and Affected Versions** Customer Reviews for WooCommerce versions prior to 5.120.1 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can permanently delete arbitrary attachments from the Media Library, such as administrator-owned product images, logos, and documents. This is achieved by injecting attachment IDs into a review that is subsequently trashed and purged. The attack targets the `cr local forms submit` handler and requires a public review-form link containing a 13-hex `formId` to expose the nonce needed to access the handler without a WordPress account or session. **Recommendations** Update to a version later than 5.120.0.