CVE-2026-12684— Customer Reviews for WooCommerce < 5.113.0 - Unauthenticated Arbitrary Media Upload via cr_upload_media
Quick assessment
Affected
Unknown Customer Reviews for WooCommerce
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress Customer Reviews for WooCommerce是WordPress基金会的一个为WooCommerce添加客户评价功能的插件。 WordPress Customer Reviews for WooCommerce 5.113.0之前版本存在任意文件上传漏洞，该漏洞源于未对媒体上传AJAX操作进行身份验证、权限或nonce检查，允许未经身份验证的用户上传媒体文件并创建附件帖子，导致媒体库污染和磁盘空间耗尽。
Possible ATT&CK Techniques 1 AI
T1195.002 · Compromise Software Supply ChainAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Customer Reviews for WooCommerce | < 5.113.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-12684
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Customer Reviews for WooCommerce < 5.113.0 - Unauthenticated Arbitrary Media Upload via cr_upload_media
Source: CVE Program / CVE List V5
Vulnerability Description
The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks on one of its media upload AJAX actions when the review media attachment feature is enabled, allowing unauthenticated users to upload media files (bounded to an image and video allowlist) to the Media Library and create attachment posts, leading to media library pollution and disk space exhaustion.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress Customer Reviews for WooCommerce 任意文件上传漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress Customer Reviews for WooCommerce是WordPress基金会的一个为WooCommerce添加客户评价功能的插件。 WordPress Customer Reviews for WooCommerce 5.113.0之前版本存在任意文件上传漏洞，该漏洞源于未对媒体上传AJAX操作进行身份验证、权限或nonce检查，允许未经身份验证的用户上传媒体文件并创建附件帖子，导致媒体库污染和磁盘空间耗尽。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Customer Reviews for WooCommerce | 0 ~ 5.113.0 | - |
|
II. Public POCs for CVE-2026-12684
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-12684
请登录查看更多情报信息。
Other References for CVE-2026-12684 (1)
-
🔗 Customer Reviews for WooCommerce < 5.113.0 – Unauthenticated Arbitrary Media Upload via cr_upload_media | CVE 2026-12684 | Plugin Vulnerabilities Read full article exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-07-16 · 13 CVEs total
| CVE-2026-12907 | RTMKit Addons for Elementor < 2.0.9 - Author+ Site-Wide Theme Builder Template Creation an | |
| CVE-2026-12978 | FunnelKit < 3.15.0.6 - Reflected XSS via Divi Optin Form | |
| CVE-2026-12979 | FunnelKit < 3.15.0.6 - Admin+ Arbitrary File Deletion via Path Traversal in Template Impor | |
| CVE-2026-12869 | Header Footer Builder for Elementor < 1.2.1 - Contributor+ Stored XSS via Template Import | |
| CVE-2026-12525 | Redux Framework < 4.5.13 - Subscriber+ Privilege Escalation to Administrator | |
| CVE-2026-12906 | RTMKit Addons for Elementor < 2.0.9 - Contributor+ Private Post Title Disclosure | |
| CVE-2026-12510 | AI Engine < 3.5.5 - Subscriber+Chatbot Discussion Disclosure and Takeover via IDOR | |
| CVE-2026-12585 | Abandoned Cart Lite for WooCommerce < 6.8.2 - Unauthenticated Account Takeover via Malleab | |
| CVE-2026-11866 | LatePoint < 5.6.3 - Multiple Privileged Actions via CSRF | |
| CVE-2026-11371 | BetterDocs < 4.5.5 - Unauthenticated Stored XSS via AI Doc Summarizer Prompt Injection | |
| CVE-2026-12492 | Happy Coders OTP Login for WooCommerce < 2.8 - Unauthenticated Account Takeover via hcotp_ | |
| CVE-2026-12395 | WP Job Portal < 2.5.5 - Subscriber+ SQL Injection via Applied Resumes 'ta' Parameter |
IV. Related Vulnerabilities
Same product: Customer Reviews for WooCommerce
-
CVE-2026-96823
WordPress Customer Reviews for WooCommerce plugin <= 5.120.0 -
CVE-2026-89055
Customer Reviews for WooCommerce <= 5.120.0 - Missing Author -
CVE-2026-76585
Customer Reviews for WooCommerce < 5.118.0 - Unauthenticated -
CVE-2026-6176
Customer Reviews for WooCommerce <= 5.106.0 - Unauthenticate -
CVE-2026-14941
Customer Reviews for WooCommerce < 5.116.0 - Subscriber+ Mis
Same vendor: Unknown
-
CVE-2026-96173
Payments for Hubtel < 1.0.2 - Unauthenticated Order Key Disc -
CVE-2026-96200
Payments for Hubtel < 1.0.2 - Unauthenticated Payment Confir -
CVE-2026-96255
Payments for Hubtel < 1.0.2 - Unauthenticated Payment Gatewa -
CVE-2026-89296
Pro Like Button < 2.0 - Unauthenticated SQLi via 'postid' Pa -
CVE-2026-87973
If-So Dynamic Content 1.9.9 - 1.10.1 - Editor+ Stored XSS vi
V. Comments for CVE-2026-12684
No comments yet