The Customer Reviews for WooCommerce plugin for WordPress suffers from a missing authorization (CWE-862) vulnerability in the send_test_email() function. This flaw allows any authenticated user with at least subscriber privileges to send arbitrary test emails via the plugin, due to the absence of a capability check. The vulnerability is present in all versions up to 5.46.0. The CVSS v3.1 base score is 4.3 (medium), reflecting low complexity and low privileges required but limited impact confined to email sending without direct confidentiality or availability impact.

An attacker with subscriber-level access can exploit this vulnerability to send arbitrary test emails. This could be used to send unsolicited emails or phishing attempts from the affected site, potentially damaging reputation or causing user confusion. There is no direct impact on confidentiality or availability reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider restricting subscriber-level access or disabling the test email functionality if possible. Monitor vendor channels for updates and apply patches promptly once available.