CVE-2026-8615: CWE-862 Missing Authorization in ghera74 ilGhera Reviso Exporter for WooCommerce
Description
The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the disconnect_callback() function in versions up to, and including, 1.2.3. The function is registered to the 'wp_ajax_wcefr-disconnect' AJAX action and unconditionally calls delete_option('wcefr-agt'), which removes the Reviso Agreement Grant Token used to authenticate API calls. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's stored Agreement Grant Token, breaking the connection between WooCommerce and the Reviso service.
CVSS v3.1
4.3medium
Affected software
ghera74
ilGhera Reviso Exporter for WooCommerce
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-8615 describes a missing authorization vulnerability (CWE-862) in the ilGhera Reviso Exporter for WooCommerce plugin. The disconnect_callback() function, registered to the 'wp_ajax_wcefr-disconnect' AJAX action, lacks capability checks and nonce verification, allowing any authenticated user with at least Subscriber privileges to invoke it. The function unconditionally deletes the 'wcefr-agt' option, which stores the Reviso Agreement Grant Token used for API authentication. This unauthorized deletion disrupts the integration between WooCommerce and the Reviso service.
Potential Impact
An authenticated attacker with Subscriber-level access or higher can delete the plugin's stored Agreement Grant Token, causing the WooCommerce-Reviso connection to break. This results in denial of service for the integration but does not directly expose sensitive data or allow code execution. The impact is limited to integrity disruption of the plugin's API authentication mechanism.
Mitigation Recommendations
No official patch or vendor advisory is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles to trusted users only and monitor for unauthorized AJAX requests targeting 'wp_ajax_wcefr-disconnect'.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 05/14/2026
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa0f0a5acd9273b49ccdee0
Added to database: 09/09/2026, 05:37:41 UTC
Last enriched: 09/17/2026, 01:15:12 UTC
Last updated: 10/24/2026, 08:45:13 UTC
Views: 73
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.