CVE-2026-14941
Customer Reviews for WooCommerce < 5.116.0 - Subscriber+ Missing Authorization via Multiple Settings AJAX Actions
MEDIUM 5.4EPSS 0.2%
The Customer Reviews for WooCommerce WordPress plugin before 5.116.0 does not perform nonce or capability checks on several settings-related AJAX actions, allowing users with minimal permissions such as Subscribers to invoke administrative settings handlers, update Customer Reviews for WooCommerce WordPress plugin before 5.116.0 options, and disclose store configuration.
- Affected
- Customer Reviews for WooCommerce
- CVSS v3.1 CNA
- 5.4 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - EPSS
- 0.23% chance of exploitation in the next 30 days, 13th percentile
- Published
- 2026-08-10
- Updated
- 2026-08-11