CVE-2026-4664

OVERVIEW The Customer Reviews for WooCommerce plugin for WordPress versions up to 5.103.0 contains an authentication bypass vulnerability in its review submission REST API endpoint. The flaw exists in the create_review_permissions_check() function, which fails to validate that stored authentication keys are non-empty before comparison. This allows unauthenticated attackers to bypass permission controls and submit, modify, or inject product reviews via the POST /ivole/v1/review endpoint. SEVERITY The vulnerability is network-accessible with low attack complexity and requires no user interaction or authentication, making it easily exploitable by remote attackers. The CVSS v3.1 score of 5.3 (MEDIUM) reflects limited integrity impact, as the primary risk involves unauthorized review creation and modification. The attack surface is particularly concerning because reviews are auto-approved by default, enabling attackers to inject malicious or defamatory content immediately without administrator review. EXPLOITATION STATUS There is no evidence of active exploitation in the wild. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and has not been added to any hot list tracking. However, the FAUCET risk score of 41.0/100 and relatively straightforward exploitation method suggest organizations should apply patches promptly to prevent potential abuse. Community attention remains minimal at this time.