CVE-2026-121518
Deferred Deferred - Pending Action

Sensitive Information Exposure in Customer Reviews for WooCommerce Plugin

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: Wordfence

Description
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 5.127.0 via the 'search' parameter of the cr_show_more_all_reviews and cr_show_more_reviews AJAX actions. This is due to the handlers being hooked on wp_ajax_nopriv_* without a capability check (and, in the product-page handler, with a nonce check that is behind a filter defaulting to false) while passing the visitor-supplied search string straight into get_comments() as the 'search' argument, which core expands into LIKE conditions over comment_author, comment_author_email, comment_author_url, comment_author_IP and comment_content. This makes it possible for unauthenticated attackers to extract review author email addresses and IP addresses — fields WordPress and WooCommerce never expose to the public — one character at a time by observing whether the returned result set matches a probed substring.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-121518
EUVD
EUVD-2026-124992

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ivole Customer Reviews for WooCommerce From 0 (inc) to 5.127.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Customer Reviews for WooCommerce plugin for WordPress has a vulnerability that allows unauthenticated attackers to access sensitive information. This happens because the plugin exposes review author email addresses and IP addresses through AJAX actions without proper access controls. Attackers can extract these details one character at a time by probing the search parameter.

Detection Guidance

I don't know

Check WordPress plugin versions for 'Customer Reviews for WooCommerce' up to 5.127.0. Look for unauthorized AJAX requests to wp-admin/admin-ajax.php with cr_show_more_all_reviews or cr_show_more_reviews actions and search parameters.

Impact Analysis

This vulnerability could allow attackers to gather private user data like email addresses and IP addresses from product reviews. If exploited, it may lead to privacy breaches, targeted phishing attacks, or unauthorized tracking of users. The impact is higher for sites with sensitive user interactions.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data without consent and HIPAA if user emails or IPs are linked to protected health information. Organizations may face fines or legal action for failing to protect sensitive user data under these regulations.

Mitigation Strategies

Update the 'Customer Reviews for WooCommerce' plugin to the latest version beyond 5.127.0. If an update is unavailable, consider disabling the plugin temporarily until a patch is released.

Review server logs for suspicious AJAX requests to admin-ajax.php with the vulnerable parameters. Implement WAF rules to block such requests if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121518. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...