Plugin Name: Customer Reviews for WooCommerce
- Software Type: Plugin
- Software Slug: customer-reviews-woocommerce
- Software Status: Active
- Software Author: ivole
- Software Downloads: 3,898,158
- Active Installs: 60,000
- Last Updated: February 13, 2024
- Patched Versions: 5.39.0
- Affected Versions: <= 5.38.12
- Name: Customer Reviews for WooCommerce <= 5.38.12
- Title: Improper Authorization via submit_review
- Type: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- CVE: CVE-2024-1044
- CVSS Score: 5.3
- Publicly Published: February 6, 2024
- Researcher: Francesco Carlucci
- Description: The Customer Reviews for WooCommerce plugin, a widely used tool for integrating customer feedback mechanisms into WooCommerce stores, harbors a vulnerability in its 'submit_review' function. Due to a lack of proper capability checks, versions up to 5.38.12 are susceptible to unauthorized data modification, allowing unauthenticated users to submit reviews with arbitrary email addresses, even when review submissions are disabled site-wide.
The Customer Reviews for WooCommerce plugin, integral to many e-commerce sites for gathering and displaying customer feedback, has been found vulnerable to unauthorized review submissions due to improper authorization checks in versions up to 5.38.12. This vulnerability, which has been effectively remedied in the recent update to version 5.39.0, highlights the critical importance of robust security measures in plugin development and maintenance.
Identified by security researcher Francesco Carlucci, this vulnerability underscores the potential risks associated with insufficient authorization mechanisms within WordPress plugins. The ability for unauthenticated users to submit reviews poses a threat to the integrity of customer feedback and the overall credibility of WooCommerce sites. The prompt issuance of a patch in version 5.39.0 by the plugin developers reflects the urgency of addressing such vulnerabilities to maintain user trust and site security.
Advice for Users:
- Immediate Action: Users of the Customer Reviews for WooCommerce plugin are strongly encouraged to update to version 5.39.0 immediately to safeguard their sites from potential exploitation of this vulnerability.
- Check for Signs of Vulnerability: Site administrators should review submitted reviews for any suspicious entries that may have resulted from the exploitation of this vulnerability and assess the need for further security measures.
- Alternate Plugins: While the patched version addresses this specific issue, exploring alternative review management plugins can offer additional features and security options.
- Stay Updated: Regularly updating all WordPress plugins and themes is essential for protecting against known vulnerabilities and enhancing site security.
The resolution of the improper authorization vulnerability in the Customer Reviews for WooCommerce plugin serves as a vital reminder of the ongoing challenges in digital security management. For WordPress site owners, especially those managing e-commerce platforms, the incident underscores the importance of continuous vigilance and timely updates to ensure the security and reliability of online stores. In an era where digital threats are ever-present, the proactive management of plugin vulnerabilities is not just a technical necessity but a cornerstone of maintaining a trustworthy digital presence.