CVE-2026-110251

Name of the Vulnerable Software and Affected Versions Photo Reviews for WooCommerce versions prior to 1.2.32

Description Unauthenticated attackers can permanently delete any WordPress media library attachment, including files on disk, by exploiting a flaw in the delete reviews image() function. The issue occurs because the delete comment hook trusts attachment IDs provided via the wcpr image upload id POST parameter without verifying ownership or user capabilities. While the viwcpr filter review image ids() function checks if the ID refers to an attachment post type, it does not verify the submitter's authorization. An attacker can embed specific attachment IDs into a review comment and trigger deletion when a moderator removes the review or when the wp scheduled delete cron process purges it. The wcpr image upload nonce is a shared public value, allowing this action to be performed without an account.

Recommendations Update to a version newer than 1.2.31.