CVE-2026-12684: CWE-434 Unrestricted Upload of File with Dangerous Type in Customer Reviews for WooCommerce
The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks on one of its media upload AJAX actions when the review media attachment feature is enabled, allowing unauthenticated users to upload media files (bounded to an image and video allowlist) to the Media Library and create attachment posts, leading to media library pollution and disk space exhaustion.
AI Analysis
Technical Summary
CVE-2026-12684 is an unrestricted file upload vulnerability (CWE-434) in the Customer Reviews for WooCommerce plugin prior to version 5.113.0. The plugin does not enforce authentication, capability, or nonce verification on a media upload AJAX endpoint when the review media attachment feature is active. This allows unauthenticated users to upload files restricted to certain image and video types into the WordPress Media Library, resulting in potential media library pollution and exhaustion of disk space resources.
Potential Impact
Unauthenticated attackers can upload media files to the WordPress Media Library, which may lead to storage exhaustion and cluttering of the media repository. This could degrade site performance or availability due to disk space depletion. No direct code execution or privilege escalation is described in the provided data.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, disabling the review media attachment feature can prevent exploitation. Monitor vendor communications for updates and apply patches promptly once released.
CVE-2026-12684: CWE-434 Unrestricted Upload of File with Dangerous Type in Customer Reviews for WooCommerce
Description
The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks on one of its media upload AJAX actions when the review media attachment feature is enabled, allowing unauthenticated users to upload media files (bounded to an image and video allowlist) to the Media Library and create attachment posts, leading to media library pollution and disk space exhaustion.
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-12684 is an unrestricted file upload vulnerability (CWE-434) in the Customer Reviews for WooCommerce plugin prior to version 5.113.0. The plugin does not enforce authentication, capability, or nonce verification on a media upload AJAX endpoint when the review media attachment feature is active. This allows unauthenticated users to upload files restricted to certain image and video types into the WordPress Media Library, resulting in potential media library pollution and exhaustion of disk space resources.
Potential Impact
Unauthenticated attackers can upload media files to the WordPress Media Library, which may lead to storage exhaustion and cluttering of the media repository. This could degrade site performance or availability due to disk space depletion. No direct code execution or privilege escalation is described in the provided data.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, disabling the review media attachment feature can prevent exploitation. Monitor vendor communications for updates and apply patches promptly once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-06-19T07:49:11.659Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a5877a968715ace43806865
Added to database: 07/16/2026, 06:18:17 UTC
Last enriched: 07/16/2026, 06:32:56 UTC
Last updated: 07/16/2026, 20:00:00 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.