The Customer Reviews for WooCommerce plugin suffers from an improper access control vulnerability (CWE-284) due to the absence of a capability check in the 'submit_review' function. This flaw enables unauthenticated attackers to submit reviews with arbitrary email addresses regardless of the global review enablement setting. The vulnerability affects all versions up to 5.38.12 and has a CVSS 3.1 base score of 5.3 (medium severity), reflecting its network attack vector, low complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No known exploits in the wild have been reported, and no patch or vendor advisory has been provided yet.

The vulnerability allows unauthenticated attackers to submit arbitrary reviews with spoofed email addresses, which can lead to unauthorized modification of review data. This may affect the integrity of customer reviews, potentially misleading users relying on review authenticity. There is no impact on confidentiality or availability. No known exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling the Customer Reviews for WooCommerce plugin or restricting access to review submission endpoints via web application firewall rules or other access controls to prevent unauthorized review submissions.