CVE-2026-100517

Summary

An unauthenticated IDOR vulnerability allows attackers to access photo review data that should be restricted, potentially leading to unauthorized access to sensitive user-generated content and review information.

Exploitability

Exploitation is straightforward with no authentication required, though it may need knowledge of specific object identifiers to target particular reviews.

Blast radius

The impact could be significant as attackers can access all photo reviews across the WooCommerce store without needing credentials, potentially exposing sensitive user feedback and review data.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Photo Reviews for WooCommerce version 1.2.31 or later to address this IDOR vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.