CVE-2026-101923 villatheme CVE debrief

Who should care

Defenders responsible for WordPress installations with the Photo Reviews for WooCommerce plugin should assess exposure and prioritize verification and updates to prevent arbitrary content deletion.

Why it matters

The Photo Reviews for WooCommerce plugin vulnerability allows unauthenticated attackers to delete arbitrary content, posing a significant risk to WordPress installations. Defenders should prioritize verification and updates to prevent this vulnerability.

• Unauthenticated attackers can delete arbitrary posts, pages, products, or media attachments
• Arbitrary content deletion can occur when an administrator deletes the attacker's review or when WordPress's built-in wp_scheduled_delete cron empties the comment trash after 30 days
• Defenders must verify and update the Photo Reviews for WooCommerce plugin to prevent arbitrary content deletion

Technical summary

The Photo Reviews for WooCommerce plugin for WordPress stores attacker-controlled post IDs from the wcpr_image_upload_id parameter of a public review submission into the review's reviews-images comment meta without verifying that the IDs correspond to attachments owned by the submitter. The delete_reviews_image() handler unconditionally calls wp_delete_post( $id, true ) on every stored ID when the review is deleted, allowing for arbitrary content deletion.

Defensive priority

Defenders should prioritize verifying and updating the Photo Reviews for WooCommerce plugin to prevent arbitrary content deletion.

Recommended defensive actions

• Verify and update the Photo Reviews for WooCommerce plugin to the latest version
• Monitor for suspicious review deletion activity
• Implement additional logging and monitoring for WordPress installations
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability exists due to the plugin storing attacker-controlled post IDs without verification, allowing for arbitrary content deletion. The delete_reviews_image() handler unconditionally calls wp_delete_post on every stored ID when the review is deleted. Defenders should verify the Photo Reviews for WooCommerce plugin version and update to the latest version. The CVE record was published on 2026-10-03T06:16:39.603Z and has not been modified since then. There are references to plugin code reviews available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.