CVE WatchJul 16, 2026

CVE-2026-12684

The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks on one of

CVSS

6.5

Medium

EPSS

0.2%

p16

KEV

—

Exploit Today

0-100

Published: Jul 16, 2026 · Last modified: Jul 16, 2026 · CWE-434

EPSS · 30d

0.2%EPSS · 30 days0.2%

2026-07-162026-07-20

Technical description

The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks on one of its media upload AJAX actions when the review media attachment feature is enabled, allowing unauthenticated users to upload media files (bounded to an image and video allowlist) to the Media Library and create attachment posts, leading to media library pollution and disk space exhaustion.

Official references

wpscan.comhttps://wpscan.com/vulnerability/169d3455-dd98-4b0b-b6c1-6c9c28aa9707/

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-562919.8 CRI

94.5%

KEV—78Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability10d CVE-2026-562909.8 CRI

85.5%

KEV—76Joomlack Page Builder Improper Access Control Vulnerability12d CVE-2026-489089.8 CRI

72.6%

KEV—72JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability12d CVE-2026-489399.8 CRI

71.5%

KEV—71iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability10d CVE-2023-388368.8 HIG

99.3%

——30File Upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute arbitrary code by adding a GIF header to bypass MIME type checks.12d CVE-2023-464747.2 HIG

97.3%

——29File Upload vulnerability PMB v.7.4.8 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted PHP file uploaded to the start_import.php file.12d