CVE-2026-89055 — CusRev WooCommerce Missing Authorization (Arbitrary Media Deletion)

Overview

CVE-2026-89055 affects Customer Reviews for WooCommerce (Ivole CusRev, slug customer-reviews-woocommerce).

The public local review form AJAX handler cr_local_forms_submit lacks proper authorization on items[].media. A party with a legitimate customer review link (/cusrev/{13-hex formId}/ from post-order email) can obtain crSubmitNonce and submit reviews whose media array references arbitrary WordPress attachment IDs (product images, logos, PDFs, etc.).

When the review comment is permanently deleted (trash purge, spam cleanup), delete_review_media_attachments() calls wp_delete_attachment() on each linked ID without ownership checks — leading to arbitrary media deletion (integrity and availability impact).

Affected versions

| | | |---|---| | Plugin | Customer Reviews for WooCommerce | | Affected | ≤ 5.120.0 | | Fixed in | > 5.120.0 (upgrade to latest stable) | | CVSS 3.1 | 9.1 Critical (C:N/I:H/A:H) | | CWE | CWE-862 (Missing Authorization) | | Prerequisite | Valid public /cusrev/{formId}/ review link (nonce on page) |

This is not a fully unauthenticated internet-wide spray: exploitation requires a form link (often leaked via email, support tickets, or shared URLs). Mass scanning still needs per-target form IDs.

Attack chain

1. Open {site}/cusrev/{formId}/ → read crSubmitNonce and product data-itemid values.
2. POST admin-ajax.php: action=cr_local_forms_submit with items[n][media][]=<victim_attachment_id>.
3. Plugin stores attachment IDs in review comment meta (ivole_reviews_locl_img / video fields).
4. When the review is permanently removed, hooked cleanup deletes every linked attachment file.

The bundled PoC implements steps 1–2 on authorized targets. Step 4 depends on site/admin lifecycle (review purge); output may include a chain_note documenting this.

Bundled PoC (PoCbit download)

Python 3 check / exploit tool:

• check — Plugin version fingerprint, optional live form parse (nonce + line items) when --form-url or --form-id is supplied.
• exploit — Injects a foreign attachment-id into the first product line item; optional --verify-url for the victim media URL.

Mass mode: --list targets.txt (optional form path after | per line). Authorized testing only.

Impact

• Integrity / availability of Media Library assets tied to deleted reviews.
• Potential storefront breakage (missing product images, branding assets).
• Does not by itself grant admin access; impact is destructive file deletion chained off review workflow.

Remediation

1. Upgrade CusRev to > 5.120.0.
2. Rotate or expire old /cusrev/ links where possible; treat leaked review URLs as sensitive.
3. Monitor admin-ajax.php for anomalous cr_local_forms_submit with unexpected attachment IDs.
4. Back up uploads and restrict who can purge reviews until patched.

Legal and ethical use

Test only WooCommerce sites you operate or have explicit written permission to assess. Do not use customer review links from real orders without authorization.

References

• GitHub PoC (source): https://github.com/murrez/CVE-2026-89055
• NVD — CVE-2026-89055
• CVE Program
• Plugin: customer-reviews-woocommerce on WordPress.org