CVE-2026-4664 is an authentication bypass vulnerability in the Customer Reviews for WooCommerce plugin for WordPress, affecting all versions up to 5.103.0. The vulnerability arises from the `create_review_permissions_check()` function, which compares the user-supplied `key` parameter against the order's `ivole_secret_key` meta value using strict equality without verifying that the stored key is non-empty. For orders without a review reminder email sent, the `ivole_secret_key` is unset and returns an empty string. An attacker can exploit this by supplying an empty string as the key, bypassing the permission check and allowing unauthenticated submission and modification of product reviews through the REST API endpoint `POST /ivole/v1/review`. Since the plugin defaults to auto-approving reviews, this can lead to unauthorized and potentially malicious reviews being published.

Unauthenticated attackers can bypass authentication controls to submit and modify product reviews on any product via the plugin's REST API. The reviews are auto-approved by default, which can lead to injection of unauthorized or malicious content into product reviews. There is no impact on confidentiality or availability reported, but the integrity of product reviews is compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling the affected plugin or restricting access to the REST API endpoint to trusted users only. Additionally, enabling review moderation in the plugin settings can reduce the risk of malicious reviews being published automatically.