WooCommerce Photo Reviews Plugin Arbitrary Content Deletion

The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Arbitrary Content Deletion in versions up to, and including, 1.2.30. This is due to the plugin storing attacker-controlled post IDs from the wcpr_image_upload_id parameter of a public review submission into the review's reviews-images comment meta without verifying that the IDs correspond to attachments owned by the submitter, combined with the delete_reviews_image() handler unconditionally calling wp_delete_post( $id, true ) on every stored ID when the review is deleted. This makes it possible for unauthenticated attackers to permanently delete arbitrary posts, pages, products, or media attachments on the site whenever an administrator subsequently deletes the attacker's review (or when WordPress's built-in wp_scheduled_delete cron empties the comment trash after 30 days).

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Photo Reviews for WooCommerce plugin contains a critical authorization bypass vulnerability (CWE-862) affecting versions up to 1.2.30. By exploiting insufficient input validation on the wcpr_image_upload_id parameter, attackers can delete arbitrary attachments and content from WordPress installations. This impacts any e-commerce site using this plugin for customer product reviews, potentially destroying legitimate business data, disrupting store operations, and enabling competitive sabotage. The vulnerability is particularly dangerous because it requires no authentication—any public review submission can be weaponized to target any post or attachment on the site.

Casky's 283 mapped security skills use Claude's extended reasoning to detect the attack chain underlying this vulnerability across MITRE ATT&CK's Privilege Escalation (TA0004) and Persistence (TA0006) tactics. Practitioners querying Casky would identify behavioral indicators including: unsanitized parameter handling in review submission handlers, missing ownership verification before delete operations, and improper use of WordPress's wp_delete_post() without capability checks. The platform's skill mapping reveals how attackers progress from Initial Access (public form submission) through Execution (malicious parameter injection) to Impact (data destruction), allowing security teams to implement detection rules for abnormal attachment deletion patterns, monitor for suspicious wcpr_image_upload_id values with non-sequential IDs, and enforce post ownership validation before any deletion operations.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-101923.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-101923

Casky has 283 skills that investigate the attack patterns behind CVE-2026-101923. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn