WordPress Plugin Vulnerabilities

Photo Reviews for WooCommerce < 1.2.31 - Unauthenticated Insecure Direct Object Reference

Description

The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.30. This is due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
woo-photo-reviews
Fixed in 1.2.31

References

CVE
CVE-2026-100517
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/2067541c-8642-42a4-82ad-ea4db78f8a4a

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
V1T
Verified
No
WPVDB ID
17ff4a2b-c1fe-4ad7-a5c7-be94fdc71b36

Timeline

Publicly Published
2026-10-01 (about 15 days ago)
Added
2026-10-08 (about 8 days ago)
Last Updated
2026-10-08 (about 8 days ago)

Other

Published
Title
Published
2024-08-20
Title
Zephyr Project Manager < 3.3.103 - Missing Authorization to Authenticated (Subscriber+) Status Updates
Published
2024-04-24
Title
SP Project & Document Manager <= 4.71 - Data Update via IDOR
Published
2026-07-08
Title
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration < 4.3.8 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Modification via 'wpuf_files_data' Parameter
Published
2026-07-13
Title
Essential Addons for Elementor - Lite < 6.6.10 - Unauthenticated Draft/Private WooCommerce Product Disclosure via Compare Table
Published
2023-08-01
Title
Stripe Payment Plugin for WooCommerce < 3.7.8 - Authentication Bypass