The vulnerability in the Customer Reviews for WooCommerce plugin is due to improper authentication (CWE-287) in the create_review_permissions_check() function. The function compares the user-supplied 'key' parameter against the order's 'ivole_secret_key' meta value using strict equality without checking if the stored key is non-empty. For orders lacking a review reminder email, the stored key is empty, enabling an attacker to bypass the permission check by supplying an empty key. This bypass permits unauthenticated access to the POST /ivole/v1/review REST API endpoint to submit or modify product reviews, which are auto-approved by default because moderation is disabled by default.

An unauthenticated attacker can bypass authentication controls to submit, modify, or inject product reviews on any product, including those not linked to the referenced order. Since reviews are auto-approved by default, this can lead to unauthorized content injection affecting product reputation and potentially misleading customers. There is no impact on confidentiality or availability reported. The CVSS v3.1 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, consider disabling the affected plugin or restricting access to the REST API endpoint if possible. Monitor vendor communications for updates and apply official patches once released.