CVE-2026-96823

Executive Summary

CVE-2026-96823 is an unauthenticated arbitrary content deletion vulnerability in the WordPress plugin "Customer Reviews for WooCommerce" affecting versions up to and including 5.120.0. The flaw stems from a missing authorization control (CWE-862) on a plugin-exposed function, allowing any unauthenticated remote attacker to delete arbitrary content managed by the plugin. Successful exploitation degrades integrity and availability of review-related site content and can disrupt storefront trust signals, with no confidentiality impact and no authentication or user interaction required.

Technical Analysis

The vulnerability is classified under CWE-862 (Missing Authorization). The NVD description states that the "Customer Reviews for WooCommerce" plugin, in versions 5.120.0 and earlier, exposes functionality that performs content deletion without enforcing an authorization check, and that this functionality is reachable by unauthenticated users.

At the vulnerability-class level, the mechanism is as follows:

• The plugin registers one or more callable endpoints or handlers (for example, an AJAX action, REST route, or admin-post handler) that perform a destructive operation on review content or associated records.
• The handler is intended to be invoked only by privileged users (for example, an administrator or a user with the capability to moderate reviews). The expected safeguard is a capability check and, in the case of AJAX or REST handlers, a nonce validation.
• The missing control — the CWE-862 condition — is the absence or incorrect placement of that authorization check. Because the deletion logic itself is reachable before the capability/nonce gate is evaluated, an anonymous requester can invoke the destructive operation directly.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms the attacker profile: network-reachable (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), scoped to the vulnerable component (S:U), with no confidentiality impact (C:N), no integrity impact recorded in the vector (I:N), and high availability impact (A:H). The A:H rating reflects that deletion of content can render affected pages, review listings, or aggregate data unavailable or incomplete.

The attack surface is the plugin's publicly reachable HTTP interface on a WordPress installation. Because WordPress plugins commonly expose destructive actions through admin-ajax.php, REST API routes, or admin-post.php hooks, the exploitable surface is expected to be an HTTP request to the WordPress site itself. Specific endpoint paths, action names, parameter names, and function identifiers are not provided in the NVD description or CNA title and are therefore not asserted here.

No public proof-of-concept, exploit code, or Nuclei template is available as of this report; the attack chain below is inferred from the vulnerability class (missing authorization on a content-deletion operation).

Exploitation Scenarios

The following chain describes exploitation at the vulnerability-class level. No specific function names, endpoint paths, or parameters are fabricated; where the description is silent, the report states the class of behavior rather than inventing identifiers.

1. Reconnaissance / target identification

   • The attacker enumerates internet-facing WordPress sites and identifies those running the "Customer Reviews for WooCommerce" plugin. Passive fingerprinting is achievable via Shodan queries (for example http.html:"/wp-content/plugins/customer-reviews-woocommerce") and by inspecting plugin asset paths served from the site.
   • The attacker determines the plugin version from publicly exposed readme or asset versioning where available, and confirms that it falls at or below 5.120.0. No authentication is required for this stage.

2. Triggering the flaw class

   • Because the destructive handler performs content deletion (CWE-862) without an authorization check, the attacker issues an unauthenticated HTTP request to the plugin's deletion functionality. The relevant request is a state-changing call (for example an HTTP request that causes a delete operation), and it succeeds without a valid session, capability, or nonce.
   • The exact request shape (action name, route, parameters) is not disclosed in the available data and would require source review or validated research; no such specifics are asserted here.

3. Payload / execution method (vulnerability-class level)

   • No crafted memory-corruption payload or code execution is involved. The "payload" is simply the request that reaches the destructive handler with the target content identifier(s). Because authorization is absent rather than bypassed via injection, the attacker supplies whatever identifier the handler uses to select content to delete.
   • The attacker may repeat the request across many identifiers to delete content in bulk.

4. Post-exploitation impact

   • Arbitrary deletion of plugin-managed content (review-related records and any dependent aggregate or display data). This compromises the integrity of storefront content and the availability of review listings, eroding customer trust.
   • No confidentiality impact is expected (CVSS C:N); no direct code execution or privilege escalation is implied by the description. The primary effect is data/content destruction and service degradation.
   • Because no patch evidence exists (patch confidence 0/4), the exposure window remains open for every unpatched installation at or below 5.120.0.

Impact Assessment

• CVSS base score: 7.5 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
• Attack Vector (AV:N): exploitable remotely over the network with no local access.
• Attack Complexity (AC:L): no special conditions or race windows; low effort.
• Privileges Required (PR:N): entirely unauthenticated.
• User Interaction (UI:N): no victim action needed.
• Confidentiality (C:N): no data exposure.
• Integrity (I:N per vector): the recorded vector does not assign an integrity impact, though the deletion behavior is innately a content-modification/destruction event; the score is modeled primarily through availability.
• Availability (A:H): content deletion impairs the availability of review listings and dependent pages.
• Blast radius: all WordPress/WooCommerce installations running the affected plugin version that are reachable from untrusted networks. Multi-tenant, high-traffic, or compliance-sensitive storefronts (for example those relying on reviews for consumer disclosures) face both operational and reputational consequences.
• Business impact: loss of user-generated review content, disruption of product trust signals, potential customer complaints, and the operational cost of restoring content from backups. Absence of a vendor patch (patch confidence 0/4) elevates ongoing risk.

Detection Guidance

Sigma Rule

title: Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce (CVE-2026-96823)
id: 7c1e2f4a-9b3d-4e21-8f55-1a2b3c4d5e6f
status: experimental
description: Detects unauthenticated requests that invoke the content-deletion functionality of the Customer Reviews for WooCommerce plugin (<= 5.120.0). Tune the URI pattern to the plugin's actual deletion handler.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-96823
author: valtersit.com
logsource:
  category: webserver
detection:
  selection_plugin:
    cs-uri-query|contains:
      - 'customer-reviews-woocommerce'
      - 'cr_'
  selection_delete:
    cs-uri-query|contains:
      - 'delete'
      - 'remove'
  selection_unauthenticated:
    cs-cookie|contains:
      - 'wordpress_logged_in'
  condition: selection_plugin and selection_delete and not selection_unauthenticated
fields:
  - c-ip
  - cs-method
  - cs-uri-stem
  - cs-uri-query
  - cs-user-agent
falsepositives:
  - Legitimate authenticated administrative deletions (suppressed by the cookie negation)
  - Caching or crawler requests that happen to match keyword patterns
level: high

YARA Rule

rule CVE_2026_96823_Customer_Reviews_WooCommerce_Missing_AuthZ
{
    meta:
        description = "Detects Customer Reviews for WooCommerce plugin code (<= 5.120.0) exhibiting missing authorization patterns around content deletion"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-96823"
        cve = "CVE-2026-96823"
        date = "2026-01-01"

    strings:
        $plugin = "customer-reviews-woocommerce" ascii wide nocase
        $del1 = "delete" ascii wide
        $del2 = "remove" ascii wide

    condition:
        $plugin and 1 of ($del*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-96823 Attempted Unauthenticated Content Deletion - Customer Reviews for WooCommerce"; flow:established,to_server; http.uri; content:"customer-reviews-woocommerce"; http.uri; content:"delete"; nocase; http.cookie; content:!"wordpress_logged_in"; nocase; classtype:attempted-admin; reference:cve,2026-96823; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-96823; sid:2026683001; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where network.protocol == "http" and
     http.request.method in ("GET", "POST") and
     url.path contains "customer-reviews-woocommerce"]
  [network where network.protocol == "http" and
     url.query contains "delete" and
     not http.request.headers.cookie contains "wordpress_logged_in"]

Splunk SPL Query

index=web sourcetype=access_combined
  (uri_path="*customer-reviews-woocommerce*" OR uri_query="*customer-reviews-woocommerce*")
  (uri_query="*delete*" OR uri_query="*remove*")
  NOT (cookie="*wordpress_logged_in*")
| stats count, values(uri_path) as paths, values(src_ip) as src_ips by src_ip, status
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,cve-2026-96823,">
  <rule id="100968" level="10">
    <if_sid>31100</if_sid>
    <match>customer-reviews-woocommerce</match>
    <regex>delete|remove</regex>
    <description>CVE-2026-96823: Possible unauthenticated content deletion attempt against Customer Reviews for WooCommerce</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_96823,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround is available as of this report; all guidance below is defensive and independent of a vendor patch.

1. Immediate mitigations

   • Disable or deactivate the "Customer Reviews for WooCommerce" plugin on any installation where review deletion functionality can be reached by unauthenticated users and cannot be restricted.
   • Where deactivation is not possible, restrict access to the plugin's deletion endpoints using a Web Application Firewall (WAF) or reverse-proxy rule that blocks unauthenticated state-changing requests to the affected functionality.
   • Require authentication and enforce capability checks at the edge: deny anonymous requests targeting deletion actions and monitor for bypass attempts.
   • Ensure full, recent backups of WordPress content, including plugin tables and user-generated content, and verify restore procedures.

2. Patch / upgrade steps

   • No patch is available (patch confidence 0/4; patch sources empty). Monitor the vendor ("Customer Reviews for WooCommerce") and the WordPress plugin repository for an updated version and upgrade immediately when released.
   • Because the affected range is <= 5.120.0, an upgrade to any version the vendor designates as fixed would remediate; no such version is confirmed in the available data and must not be assumed.

3. Long-term hardening

   • Minimize the attack surface by removing unused plugins and keeping the entire WordPress stack (core, themes, plugins) current.
   • Enforce the principle of least privilege on all plugin-exposed endpoints; validate authorization and nonces server-side on every state-changing action.
   • Deploy continuous monitoring (WAF, IDS, and application logging) tuned to plugin URI patterns as shown in the detection rules above.
   • Subscribe to authoritative vulnerability feeds (NVD, WordPress plugin advisories, CISA KEV) and re-assess risk as new details, PoCs, or patches emerge.

References

• NVD — CVE-2026-96823: https://nvd.nist.gov/vuln/detail/CVE-2026-96823
• CWE-862 Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• WordPress Plugin Security / advisories: https://wpscan.com/
• CISA Known Exploited Vulnerabilities catalog (check current status; not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (no score recorded at time of writing): https://www.first.org/epss/

Threat actor campaigns and exploit-in-the-wild evidence: none identified in the provided data. No public PoC, exploit code, or Nuclei template is available; CISA KEV status is negative. Exploitation activity should be treated as possible and detection rules above applied proactively given the unauthenticated, low-complexity nature of the flaw.