Customer Reviews for WooCommerce Vulnerability – Improper Authorization via submit_review – CVE-2024-1044 | WordPress Plugin Vulnerability Report

Plugin Name: Customer Reviews for WooCommerce

Key Information:

  • Software Type: Plugin
  • Software Slug: customer-reviews-woocommerce
  • Software Status: Active
  • Software Author: ivole
  • Software Downloads: 3,898,158
  • Active Installs: 60,000
  • Last Updated: February 13, 2024
  • Patched Versions: 5.39.0
  • Affected Versions: <= 5.38.12

Vulnerability Details:

  • Name: Customer Reviews for WooCommerce <= 5.38.12
  • Title: Improper Authorization via submit_review
  • Type: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
  • CVE: CVE-2024-1044
  • CVSS Score: 5.3
  • Publicly Published: February 6, 2024
  • Researcher: Francesco Carlucci
  • Description: The Customer Reviews for WooCommerce plugin, a widely used tool for integrating customer feedback mechanisms into WooCommerce stores, harbors a vulnerability in its 'submit_review' function. Due to a lack of proper capability checks, versions up to 5.38.12 are susceptible to unauthorized data modification, allowing unauthenticated users to submit reviews with arbitrary email addresses, even when review submissions are disabled site-wide.


The Customer Reviews for WooCommerce plugin, integral to many e-commerce sites for gathering and displaying customer feedback, has been found vulnerable to unauthorized review submissions due to improper authorization checks in versions up to 5.38.12. This vulnerability, which has been effectively remedied in the recent update to version 5.39.0, highlights the critical importance of robust security measures in plugin development and maintenance.

Detailed Overview:

Identified by security researcher Francesco Carlucci, this vulnerability underscores the potential risks associated with insufficient authorization mechanisms within WordPress plugins. The ability for unauthenticated users to submit reviews poses a threat to the integrity of customer feedback and the overall credibility of WooCommerce sites. The prompt issuance of a patch in version 5.39.0 by the plugin developers reflects the urgency of addressing such vulnerabilities to maintain user trust and site security.

Advice for Users:

  • Immediate Action: Users of the Customer Reviews for WooCommerce plugin are strongly encouraged to update to version 5.39.0 immediately to safeguard their sites from potential exploitation of this vulnerability.
  • Check for Signs of Vulnerability: Site administrators should review submitted reviews for any suspicious entries that may have resulted from the exploitation of this vulnerability and assess the need for further security measures.
  • Alternate Plugins: While the patched version addresses this specific issue, exploring alternative review management plugins can offer additional features and security options.
  • Stay Updated: Regularly updating all WordPress plugins and themes is essential for protecting against known vulnerabilities and enhancing site security.


The resolution of the improper authorization vulnerability in the Customer Reviews for WooCommerce plugin serves as a vital reminder of the ongoing challenges in digital security management. For WordPress site owners, especially those managing e-commerce platforms, the incident underscores the importance of continuous vigilance and timely updates to ensure the security and reliability of online stores. In an era where digital threats are ever-present, the proactive management of plugin vulnerabilities is not just a technical necessity but a cornerstone of maintaining a trustworthy digital presence.


In today's digital marketplace, the security of e-commerce platforms is not just a preference but a necessity. The discovery of a vulnerability, CVE-2024-1044, within the "Customer Reviews for WooCommerce" plugin, underscores the ongoing battle against cybersecurity threats and the critical need for constant vigilance. This plugin, pivotal for e-commerce sites in collecting and displaying customer reviews, encountered an improper authorization flaw that could potentially compromise the integrity of user feedback and, by extension, the trustworthiness of the platform.

Plugin Overview:

"Customer Reviews for WooCommerce" is a widely utilized plugin designed to enrich WooCommerce stores with comprehensive customer review functionalities. Developed by ivole, it boasts over 3.8 million downloads and serves 60,000 active installations, making it a significant component in the WordPress ecosystem. The plugin facilitates a direct channel for customer feedback, crucial for the credibility and improvement of online stores.

Vulnerability Details:

CVE-2024-1044 highlights an improper authorization issue present in versions up to 5.38.12 of the plugin, where the 'submit_review' function lacked the necessary capability checks. This gap allowed unauthenticated users to bypass standard review submission protocols, enabling the posting of reviews with arbitrary email addresses, even when such functionalities were globally disabled. Identified by Francesco Carlucci and published on February 6, 2024, this vulnerability was promptly addressed in the updated version 5.39.0.

Potential Risks:

The vulnerability posed significant risks, including the potential for spam or malicious content to infiltrate the review section, undermining the authenticity of customer feedback and eroding consumer trust. For small business owners, whose success heavily relies on reputation and customer satisfaction, such vulnerabilities could lead to damaging consequences, affecting both brand credibility and sales.

Remediation Steps:

In response to CVE-2024-1044, the plugin developers released a patched version, 5.39.0, to address the improper authorization issue. Users of the plugin are urged to update to this latest version to safeguard their sites. Additionally, conducting regular reviews of site activity and user submissions can help detect any anomalies or exploitation attempts, further reinforcing site security.

Historical Context:

This incident is not isolated, with 11 previous vulnerabilities reported since September 22, 2022, highlighting the importance of ongoing security assessments and updates in the lifecycle of WordPress plugins. Each vulnerability presents a learning opportunity and a reminder of the potential security implications inherent in plugin use.

Concluding Thoughts:

The swift resolution of CVE-2024-1044 by the plugin's developers serves as a testament to the importance of timely updates and proactive security measures in the digital realm. For small business owners juggling myriad responsibilities, understanding the necessity of regular plugin updates and employing security best practices is crucial for maintaining a secure and trustworthy online presence. In an era where cybersecurity threats are ever-evolving, staying informed and prepared is not just advisable but essential for safeguarding the digital storefronts that drive modern commerce.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Customer Reviews for WooCommerce Vulnerability – Improper Authorization via submit_review – CVE-2024-1044 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment