CVE-2026-8615

Deferred Deferred - Pending Action

Unauthorized Data Modification in Reviso Exporter for WooCommerce

Publication date: 2026-09-09

Last updated on: 2026-09-11

Assigner: Wordfence

Description

The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the disconnect_callback() function in versions up to, and including, 1.2.3. The function is registered to the 'wp_ajax_wcefr-disconnect' AJAX action and unconditionally calls delete_option('wcefr-agt'), which removes the Reviso Agreement Grant Token used to authenticate API calls. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's stored Agreement Grant Token, breaking the connection between WooCommerce and the Reviso service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-11

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-8615

EUVD

EUVD-2026-74690

Affected Vendors & Products

Vendor	Product	Version / Range
ilghera	woocommerce_exporter_for_reviso	to 1.2.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Reviso Exporter for WooCommerce plugin in WordPress. It allows authenticated attackers with Subscriber-level access or higher to delete the plugin's stored Agreement Grant Token by exploiting a missing capability check and nonce verification in the disconnect_callback() function. This breaks the connection between WooCommerce and the Reviso service.

Detection Guidance

Check if the Reviso Exporter for WooCommerce plugin version is 1.2.3 or earlier. Look for unauthorized deletion of the 'wcefr-agt' option in WordPress database or logs. Monitor AJAX calls to 'wp_ajax_wcefr-disconnect' from non-admin users.

Impact Analysis

If exploited, this vulnerability could allow unauthorized users to disconnect your WooCommerce store from the Reviso service. This would break API authentication, potentially disrupting order processing, invoicing, and other integrations dependent on the Reviso connection.

Compliance Impact

This vulnerability does not directly impact GDPR or HIPAA compliance as it only affects the Reviso Exporter for WooCommerce plugin by allowing unauthorized deletion of an API token. However, if the plugin handles personal or health data, disruption of its functionality could indirectly affect compliance by preventing proper data processing or logging.

Mitigation Strategies

Update the plugin to version 1.2.4 or later immediately. Ensure all users follow least privilege principles. Review server logs for suspicious AJAX disconnect actions. Consider disabling the AJAX action if not needed.

Hi! I’m here to help you understand CVE-2026-8615. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70