CVE-2026-89055 ivole CVE debrief

Who should care

WooCommerce plugin administrators, security teams, and WordPress site owners should assess exposure and prioritize remediation due to the critical severity and potential for unauthorized Media Library modifications.

Why it matters

CVE-2026-89055 is a critical vulnerability in the Customer Reviews for WooCommerce plugin for WordPress, allowing unauthorized deletion of Media Library attachments. This requires immediate attention from WooCommerce plugin administrators and security teams to verify and remediate the vulnerability.

• Potential for unauthorized deletion of Media Library attachments.
• Risk of data loss or corruption.
• Need for verification of plugin version and remediation.
• Potential impact on administrator-owned content.

Technical summary

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to improper verification of user authorization. This allows unauthenticated attackers to delete arbitrary attachments from the Media Library by injecting their IDs into a review that is later trashed and purged. The vulnerability requires a public review-form link with a 13-hex formId distributed to customers via e-mail, exposing the nonce needed to reach the handler without any WordPress account or session. This issue affects all versions up to and including 5.120.0, and administrators should verify and remediate this vulnerability as a high priority.

Defensive priority

High priority for WooCommerce plugin administrators and security teams to verify and remediate this vulnerability.

Recommended defensive actions

• Verify and update the Customer Reviews for WooCommerce plugin to the latest version.
• Restrict access to the review-form link to prevent exploitation.
• Monitor Media Library for unauthorized changes.
• Implement additional security measures to protect against unauthorized actions.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability allows unauthenticated attackers to delete arbitrary attachments by injecting IDs into a review that is later trashed and purged. This requires a public review-form link with a 13-hex formId distributed to customers via e-mail.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.