CVE-2026-101923

Executive Summary

CVE-2026-101923 is a Broken Access Control (CWE-862) vulnerability in the Photo Reviews for WooCommerce WordPress plugin, affecting versions up to and including 1.2.30. The flaw allows unauthenticated attackers to permanently delete arbitrary posts, pages, products, or media attachments by injecting attacker-controlled post IDs via the wcpr_image_upload_id parameter during public review submission, which are later processed by an insecure deletion handler. With a CVSS score of 8.1, this vulnerability poses a high integrity and availability risk to affected WordPress sites, though exploitation requires user interaction (an administrator deleting the malicious review or the automated 30-day comment trash cron).

Technical Analysis

The vulnerability resides in the Photo Reviews for WooCommerce plugin, which facilitates customer image uploads alongside product reviews. The core issue is a missing authorization check on the wcpr_image_upload_id parameter, which is accepted during public review submission. This parameter allows an attacker to specify arbitrary post IDs, which the plugin then stores in the reviews-images comment metadata for the newly created review. Critically, the plugin does not validate that these post IDs correspond to attachments owned by the submitter, nor does it restrict them to the upload context.

The second component of the vulnerability is the delete_reviews_image() handler. When a review is deleted—either manually by an administrator or automatically via WordPress's wp_scheduled_delete cron job after 30 days—this handler iterates over the stored IDs in the reviews-images meta and calls wp_delete_post( $id, true ) on each one. Because the stored IDs are attacker-controlled and unvalidated, the handler will permanently delete any post, page, product, or media attachment on the site whose ID is supplied. The true parameter forces permanent deletion, bypassing the trash.

This is a classic Broken Access Control (CWE-862) vulnerability: the plugin fails to enforce proper authorization on a user-supplied resource identifier, leading to an arbitrary content deletion vector. The attack surface is the public-facing review submission endpoint, which is accessible without authentication. The impact is severe because deleted content is unrecoverable, potentially causing data loss, site defacement (if key pages are deleted), and operational disruption.

Exploitation Scenarios

1. Reconnaissance/Target Identification: The attacker identifies a WordPress site running the vulnerable Photo Reviews for WooCommerce plugin (versions <= 1.2.30). This can be done by scanning for the plugin's assets (e.g., /wp-content/plugins/photo-reviews-for-woocommerce/) or via Shodan using the provided dorks.

2. Triggering the Flaw: The attacker submits a product review on any product page. In the review submission request, they manipulate the wcpr_image_upload_id parameter to include one or more target post IDs (e.g., the ID of a critical page or product). The plugin stores these IDs in the reviews-images comment meta for that review without verifying ownership or validity.

3. Payload/Execution: The attacker does not need to execute any code directly. Instead, they rely on the deletion handler. When an administrator reviews and deletes the malicious review (or when the scheduled cron runs after 30 days), the delete_reviews_image() function processes the stored IDs and calls wp_delete_post( $id, true ) on each, permanently deleting the targeted content.

4. Post-Exploitation Impact: The attacker can delete arbitrary posts, pages, products, or media files. This can lead to loss of critical business content, disruption of e-commerce operations (e.g., deleting product pages), and potentially exposing sensitive information if deleted pages contained private data. The deletion is irreversible, as wp_delete_post( $id, true ) bypasses the trash.

No public PoC or exploit code is available; the attack chain is inferred from the NVD description and the vulnerability class.

Impact Assessment

The CVSS v3.1 base score is 8.1 (High), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H. This indicates:

• Confidentiality Impact: None (C:N): The vulnerability does not directly expose sensitive information.
• Integrity Impact: High (I:H): Arbitrary content deletion severely compromises data integrity.
• Availability Impact: High (A:H): Deletion of critical pages or products can render the site partially or fully unavailable.
• Attack Vector: Network (AV:N): Exploitable remotely.
• Attack Complexity: Low (AC:L): No special conditions required.
• Privileges Required: None (PR:N): The attacker does not need authentication.
• User Interaction: Required (UI:R): An administrator must delete the review (or wait for the cron job).

The blast radius is the entire WordPress site: any post type (posts, pages, products, media) can be deleted. This can result in significant business disruption, loss of customer trust, and potential revenue loss for e-commerce sites. The severity is compounded by the fact that no patch is available, and exploitation is trivial once the plugin is identified.

Detection Guidance

Sigma Rule

title: Arbitrary Content Deletion via Photo Reviews for WooCommerce
id: 8f4b3c2a-1d5e-4f7b-9c8d-2a3b4c5d6e7f
status: experimental
description: Detects attempts to exploit CVE-2026-101923 by submitting reviews with suspicious wcpr_image_upload_id parameters.
author: Threat Intelligence Team
date: 2026-07-17
logsource:
  category: webserver
  product: apache
detection:
  selection:
    cs-method: 'POST'
    cs-uri-query|contains: 'wcpr_image_upload_id'
  condition: selection
falsepositives:
  - Legitimate image uploads by customers
level: high
tags:
  - attack.t1190
  - cve.2026-101923

YARA Rule

rule CVE_2026_101923_Photo_Reviews_WooCommerce_Exploit
{
    meta:
        description = "Detects exploitation attempts for CVE-2026-101923 in Photo Reviews for WooCommerce"
        author = "Threat Intelligence Team"
        date = "2026-07-17"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-101923"
        severity = "high"
    strings:
        $param = "wcpr_image_upload_id"
        $plugin_path = "photo-reviews-for-woocommerce"
        $delete_func = "delete_reviews_image"
    condition:
        any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-101923 Photo Reviews for WooCommerce Arbitrary Content Deletion Attempt"; flow:to_server,established; content:"POST"; http_method; content:"wcpr_image_upload_id"; http_uri; content:"photo-reviews-for-woocommerce"; http_uri; classtype:attempted-admin; sid:10000001; rev:1;)

Elastic Detection

network where process.name == "httpd" or process.name == "nginx"
  and http.request.method == "POST"
  and http.request.body contains "wcpr_image_upload_id"
  and http.request.uri contains "photo-reviews-for-woocommerce"

Splunk SPL Query

index=web sourcetype=access_combined
| search method=POST uri="*wcpr_image_upload_id*" uri="*photo-reviews-for-woocommerce*"
| stats count by clientip, uri, status
| where count > 0

Wazuh OSSEC Rule

<group name="web,appsec,">
  <rule id="100001" level="12">
    <if_sid>31100</if_sid>
    <match>wcpr_image_upload_id</match>
    <match>photo-reviews-for-woocommerce</match>
    <description>CVE-2026-101923: Photo Reviews for WooCommerce arbitrary content deletion attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Disable the Photo Reviews for WooCommerce plugin until a patch is available.
   • If the plugin must remain active, restrict review submission to authenticated users only (if feasible) or implement a Web Application Firewall (WAF) rule to block requests containing suspicious wcpr_image_upload_id values (e.g., non-numeric or out-of-range IDs).
   • Monitor and immediately delete any suspicious reviews, but be aware that deletion triggers the vulnerable handler—consider disabling the wp_scheduled_delete cron temporarily.

2. Patch/Upgrade Steps:

   • No patch is available. Monitor the plugin's official repository and vendor channels for updates. Once a patched version is released, upgrade immediately.

3. Long-term Hardening:

   • Implement strict input validation and authorization checks on all user-supplied parameters, especially those affecting resource identifiers.
   • Regularly audit plugins for similar broken access control issues.
   • Apply the principle of least privilege to plugin functionality and ensure that deletion operations are restricted to authorized users only.

References

• NVD - CVE-2026-101923
• WordPress Plugin Repository - Photo Reviews for WooCommerce
• CWE-862: Missing Authorization
• OWASP Top 10: Broken Access Control
• CISA KEV Catalog (CVE-2026-101923 not listed as of report date)