CVE-2026-101923 is a missing authorization vulnerability (CWE-862) in the Photo Reviews for WooCommerce plugin for WordPress versions up to and including 1.2.30. The plugin accepts post IDs from the wcpr_image_upload_id parameter in public review submissions without verifying that the submitter owns these attachments. These IDs are stored in the review's reviews-images comment meta. When a review is deleted, the delete_reviews_image() handler calls wp_delete_post($id, true) on every stored ID without authorization checks, allowing unauthenticated attackers to cause permanent deletion of arbitrary posts, pages, products, or media attachments when an administrator deletes the attacker's review or when WordPress's scheduled deletion runs.

An unauthenticated attacker can cause high-impact arbitrary deletion of content on the affected WordPress site, including posts, pages, products, and media attachments. This can lead to significant data loss and disruption of site functionality. The vulnerability requires an administrator or WordPress's scheduled deletion process to trigger the actual deletion, but the attacker can prepare the malicious review to cause deletion of arbitrary content.

No official patch or fix information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious when deleting reviews submitted by untrusted users and consider disabling or restricting the Photo Reviews for WooCommerce plugin. Monitoring for suspicious reviews and limiting review deletion privileges may reduce risk.