PT-2026-60419 · WordPress · Customer Reviews For Woocommerce

Tom C · CVE-2026-12684 · Published 2026-07-16 · Updated 2026-07-16

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Customer Reviews for WooCommerce versions prior to 5.113.0

Description When the review media attachment feature is enabled, the plugin fails to perform authentication, capability, or nonce checks on a media upload AJAX action. This allows unauthenticated users to upload media files, restricted to an image and video allowlist, to the Media Library and create attachment posts. This can result in media library pollution and exhaustion of disk space.

Recommendations Update to version 5.113.0 or later.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-12684

Affected Products

Customer Reviews For Woocommerce

References · 3

• 🔥 https://wpscan.com/vulnerability/169d3455-dd98-4b0b-b6c1-6c9c28aa9707 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-12684 · Security Note
• https://twitter.com/VulmonFeeds/status/2077677472020140038 · Twitter Post