CVE-2026-14941 is a missing authorization vulnerability (CWE-862) in the Customer Reviews for WooCommerce WordPress plugin prior to version 5.116.0. The plugin does not validate nonces or user capabilities on multiple AJAX actions related to settings management. As a result, low-privileged users can execute administrative functions, modify plugin options, and access sensitive store configuration data without proper authorization.

Users with minimal permissions (e.g., Subscribers) can perform administrative actions and update plugin settings, potentially leading to unauthorized configuration changes and disclosure of sensitive store information. This could undermine the integrity and confidentiality of the WooCommerce store's configuration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user permissions to trusted roles and monitor for unusual activity related to plugin settings. Avoid granting Subscriber or other low-privilege roles access to AJAX actions that manage plugin settings.