Threats tagged 'ghsa-qm3q-4mg3-2277'

The Photo Reviews for WooCommerce WordPress plugin up to version 1.2.31 contains a vulnerability that allows unauthenticated attackers to delete any media library attachment file. This occurs because the plugin's delete_reviews_image() function trusts attachment IDs from a public POST parameter without verifying ownership or user capabilities. Attackers can embed malicious attachment IDs in review comments and trigger deletion when a moderator removes the review or when WordPress's scheduled trash cleanup runs. The nonce used does not prevent exploitation as it is publicly available on product pages.