CVE-2026-14941 is a CWE-862 Missing Authorization vulnerability in the Customer Reviews for WooCommerce WordPress plugin prior to version 5.116.0. The plugin fails to enforce nonce or capability checks on multiple AJAX actions related to settings management. This flaw allows users with low privileges (e.g., Subscribers) to perform administrative actions, including modifying plugin options and accessing store configuration data that should be restricted. No official patch or remediation guidance is currently provided, and no known exploits are reported in the wild.

Users with minimal permissions can exploit this vulnerability to change administrative settings of the Customer Reviews for WooCommerce plugin and disclose sensitive store configuration information. This could lead to unauthorized configuration changes and potential information leakage. However, the vulnerability does not allow privilege escalation beyond the plugin settings or cause denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles and permissions to trusted users only and monitor for suspicious activity related to plugin settings. Avoid granting Subscriber or other low-privilege roles access to the affected AJAX actions if possible.