Tom C

**Name of the Vulnerable Software and Affected Versions** Customer Reviews for WooCommerce versions prior to 5.113.0 **Description** When the review media attachment feature is enabled, the plugin fails to perform authentication, capability, or nonce checks on a media upload AJAX action. This allows unauthenticated users to upload media files, restricted to an image and video allowlist, to the Media Library and create attachment posts. This can result in media library pollution and exhaustion of disk space. **Recommendations** Update to version 5.113.0 or later.