CVE-2022-0775

WooCommerce < 6.2.1 - Subscriber+ Arbitrary Comment Deletion

The WooCommerce WordPress plugin before 6.2.1 does not have proper authorisation check when deleting reviews, which could allow any authenticated users, such as subscriber to delete arbitrary comment

Affected

WooCommerce

CVSS v3.1 NVD

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS

0.68% chance of exploitation in the next 30 days, 51st percentile

Published

2024-01-16

Updated

2025-06-11

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/b76dbf37-a0a2-48cf-bd85-3ebbc2f394dd/

Security advisories

• https://wpscan.com/vulnerability/b76dbf37-a0a2-48cf-bd85-3ebbc2f394dd
• https://plugins.trac.wordpress.org/changeset/2683324
• https://developer.woocommerce.com/2022/02/22/woocommerce-6-2-1-security-fix

References

• CVE Record
• NVD entry