CVE-2026-100517

Executive Summary

CVE-2026-100517 is an unauthenticated Insecure Direct Object Reference (IDOR) vulnerability in the "Photo Reviews for WooCommerce" WordPress plugin affecting versions up to and including 1.2.30. The flaw allows a remote, unauthenticated attacker to reference internal objects directly without authorization checks. With a CVSS v3.1 base score of 7.5, impact is scoped entirely to availability (C:N/I:N/A:H) under network attack conditions with no privileges or user interaction required. No public proof-of-concept, exploit code, or patch currently exists, and the vulnerable version range remains unfixed as of this reporting.

Technical Analysis

The vulnerability class here is CWE-639: Authorization Bypass Through User-Controlled Key, commonly referred to as Insecure Direct Object Reference (IDOR). The NVD description confirms the flaw is present in "Photo Reviews for WooCommerce <= 1.2.30" and is reachable without authentication.

An IDOR arises when an application exposes a reference to an internal object (such as a record identifier) and fails to verify that the requesting principal is authorized to access that object. The critical attribute in this CVE is that access requires no authentication at all — the authorization boundary is entirely absent rather than merely misconfigured. The attacker supplies or manipulates an object reference and the application returns or acts on the referenced object because it performs no ownership or permission check against the caller.

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) precisely scopes the technical characteristics:

• Attack Vector (Network): Exploitable remotely, consistent with a WordPress plugin endpoint reachable over HTTP(S).
• Attack Complexity (Low): No specialized conditions, race windows, or configuration prerequisites are required.
• Privileges Required (None): The attacker does not authenticate, confirming the "unauthenticated" qualifier in the description.
• User Interaction (None): No victim action is needed to trigger the flaw.
• Scope (Unchanged): Impact is confined to the vulnerable component.
• Confidentiality (None) / Integrity (None) / Availability (High): The scoring model reflects that the flaw's modeled impact is to availability rather than data exposure. This is an important and slightly counterintuitive detail: although IDOR is often associated with data disclosure, the assigned vector here indicates an availability-focused outcome.

The attack surface is the publicly reachable surface of the WooCommerce storefront where the Photo Reviews plugin registers its functionality, such as review and photo handling routines. Because the plugin extends WooCommerce (a widely deployed e-commerce platform), any internet-facing store running an affected version is a candidate target.

Note on technical specificity: The NVD description and CNA title provided do not enumerate specific function names, class names, URL endpoints, REST routes, or parameter names. Per accuracy constraints, no such implementation identifiers are asserted here. The mechanism is therefore described at the vulnerability-class level rather than at the code-line level. Insufficient technical detail is available to name the exact object reference or endpoint involved.

The root cause in IDOR cases is a missing server-side authorization check: the object reference controlled by the client is trusted as an implicit authorization token. Correct remediation requires an explicit capability/ownership validation server-side prior to acting on any client-supplied identifier.

Exploitation Scenarios

No public proof-of-concept is available. The attack chain below is inferred from the vulnerability class (unauthenticated IDOR) and the NVD description; no specific code patterns, function names, or endpoints are fabricated.

1) Reconnaissance / target identification. An attacker identifies internet-facing WordPress sites running WooCommerce with the Photo Reviews for WooCommerce plugin at version 1.2.30 or lower. Fingerprinting can be performed through HTML source inspection, asset paths, or plugin enumeration, and mass identification is feasible via internet-wide scanning services using plugin-specific signatures.

2) Triggering the flaw. Because the vulnerability is an unauthenticated IDOR, the attacker interacts with the plugin's public-facing functionality and supplies or manipulates an object reference (an identifier for an internal object). The critical precondition is that no authentication is required and no authorization check binds the caller to the referenced object. The application resolves the supplied reference and proceeds to act on the corresponding object without validating the caller's entitlement.

3) Payload/execution method (class level). At the vulnerability-class level, exploitation consists of iterating or tampering with the object reference value in a request to the affected functionality. No authentication token, session, or crafted binary payload is needed. If the referenced object or operation has a destructive or resource-consuming effect, repeated or targeted requests achieve the impact modeled by the CVSS vector. Because no technical identifiers are available in the description, the exact request format is not asserted.

4) Post-exploitation impact. Per the CVSS vector (C:N/I:N/A:H), the modeled impact is availability degradation rather than confidentiality or integrity loss. Unauthenticated triggering of an operation that affects referenced objects on the target storefront could disrupt the affected review/photo functionality or the object(s) it manipulates. The precise operational effect cannot be confirmed from available data.

Exploitation maturity: None. No public exploit code, no Nuclei template, and no CISA KEV listing. Exploit-in-the-wild is not evidenced.

Impact Assessment

• Base score: 7.5 (High) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
• Availability (High): The dominant impact; an unauthenticated attacker can affect the availability of the vulnerable component.
• Confidentiality (None) / Integrity (None): No modeled loss per the assigned vector.
• Exploitability: Trivial precondition — network reachability, no auth, no user interaction, low complexity. This elevates real-world risk despite the absence of a public PoC.
• Blast radius: Any internet-facing WordPress/WooCommerce deployment running Photo Reviews for WooCommerce <= 1.2.30. Hosting infrastructure, multi-tenant hosts, and shared environments may amplify impact where the plugin is widely deployed.
• Business impact: For e-commerce storefronts, disruption of review functionality can degrade customer trust, conversion, and brand reputation. Because exploitation requires no credentials, mass opportunistic scanning is a realistic threat vector.
• Not in CISA KEV: No known active exploitation at the federal tracking level.

Detection Guidance

Sigma Rule

title: Unauthenticated IDOR Attempt Against Photo Reviews for WooCommerce
id: 9f2c7b41-3e8a-4d6b-b1f0-2026100517aa
status: experimental
description: Detects anomalous unauthenticated requests targeting Photo Reviews for WooCommerce plugin endpoints consistent with IDOR object-reference manipulation (CVE-2026-100517).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100517
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_plugin:
    cs-uri-query|contains:
      - 'photo-reviews'
      - 'photo_reviews'
      - 'prw_'
  selection_idor:
    cs-uri-query|re: '(?i)(id|review|photo|object|item|ref)=\d+'
  selection_unauth:
    cs-username: '-'
  condition: selection_plugin and selection_idor
falsepositives:
  - Legitimate unauthenticated browsing of public reviews
level: medium
tags:
  - attack.t1190
  - cwe.639

YARA Rule

rule CVE_2026_100517_PhotoReviews_WooCommerce_IDOR
{
    meta:
        description = "Detects Photo Reviews for WooCommerce plugin artifacts at affected version <= 1.2.30 (CVE-2026-100517)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100517"
        date = "2026-01-01"

    strings:
        $plugin1 = "Photo Reviews for WooCommerce" ascii wide nocase
        $plugin2 = "photo-reviews-for-woocommerce" ascii wide nocase
        $slug    = "photo-reviews" ascii wide nocase
        $ver     = /Version:\s*1\.2\.(0|1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30)/ ascii

    condition:
        (2 of ($plugin1, $plugin2, $slug)) or ($slug and $ver)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100517 Possible Unauthenticated IDOR Attempt - Photo Reviews for WooCommerce"; flow:established,to_server; http.uri; content:"photo-reviews"; nocase; http.uri; pcre:"/(?i)(id|review|photo|object|item|ref)=\d+/"; classtype:attempted-recon; reference:cve,2026-100517; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-100517; sid:2026100517; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [network where network.protocol == "http" and
    url.query contains "photo-reviews" and
    url.query regex~ ".*(id|review|photo|object|item|ref)=\\d+.*"]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri_query = coalesce(uri_query, cs_uri_query)
| where (match(lower(uri), "photo-reviews|photo_reviews|prw_"))
    AND (match(uri_query, "(?i)(id|review|photo|object|item|ref)=\d+"))
| stats count min(_time) as first_seen max(_time) as last_seen
        by src_ip, uri, uri_query, status
| where count > 5
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S")
| eval last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-100517,">
  <rule id="2026101" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>photo-reviews|photo_reviews|prw_</url>
    <regex>(?i)(id|review|photo|object|item|ref)=\d+</regex>
    <description>CVE-2026-100517: Possible unauthenticated IDOR attempt against Photo Reviews for WooCommerce</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_100517,idor,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations

• If the Photo Reviews for WooCommerce plugin is not business-critical, temporarily deactivate and remove it until a fixed release is available.
• Place the storefront behind a WAF and apply virtual patching rules that enforce authentication/authorization context on plugin-facing requests and rate-limit unauthenticated object-reference patterns.
• Restrict administrative and plugin-facing functionality to trusted IP ranges where operationally feasible.
• Monitor web server logs for anomalous unauthenticated requests containing sequential or manipulated object identifiers against plugin endpoints.

2) Patch/upgrade steps

• No vendor patch is currently identified. Monitor the WordPress plugin repository and the WooCommerce/plugin vendor channels for a fixed version above 1.2.30.
• Upon release, upgrade immediately and verify the deployed version. Re-validate that no affected version remains cached or deployed on any site in the estate.

3) Long-term hardening

• Enforce server-side authorization on every object reference; never trust client-supplied identifiers as authorization evidence.
• Maintain a software inventory for WordPress plugins and track third-party component vulnerabilities continuously.
• Apply least-privilege at the web tier and adopt defense-in-depth controls (WAF, monitoring, segmentation) for internet-facing e-commerce components.
• Establish a routine patch cadence for plugins, including monitoring of CVE feeds and vendor advisories.

References

• NVD — CVE-2026-100517: https://nvd.nist.gov/vuln/detail/CVE-2026-100517
• MITRE CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• WordPress Plugin Directory — Photo Reviews for WooCommerce (monitor for fixed release): https://wordpress.org/plugins/photo-reviews/
• CISA Known Exploited Vulnerabilities Catalog (status: not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence are associated with this CVE at the time of writing. No public proof-of-concept, Nuclei template, or exploit code was identified.