CVE-2026-8615

Name of the Vulnerable Software and Affected Versions Reviso Exporter for WooCommerce versions prior to 1.2.4

Description Unauthorized modification of data is possible due to a missing capability check and missing nonce verification in the disconnect callback() function. This function is registered to the 'wp ajax wcefr-disconnect' API endpoint and unconditionally calls delete option('wcefr-agt'), which removes the Reviso Agreement Grant Token used to authenticate API calls. Authenticated attackers with Subscriber-level access or higher can exploit this to delete the stored token and break the connection between WooCommerce and the Reviso service.

Recommendations Update to a version newer than 1.2.3.