WooCommerce Reviews Plugin Allows Unauthorized Media Deletion

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.120.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary attachments from the Media Library — including administrator-owned product images, logos, and documents — by injecting their IDs into a review that is later trashed and purged. Exploitation requires a public review-form link (a 13-hex formId distributed to customers via e-mail), which exposes the nonce needed to reach the handler without any WordPress account or session.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Customer Reviews for WooCommerce plugin contains a critical authorization bypass vulnerability (CVE-2026-89055, CVSS 9.1) affecting all versions up to 5.120.0. The plugin fails to properly validate user permissions before processing deletion requests, allowing unauthenticated attackers to permanently remove arbitrary files from WordPress Media Libraries. By injecting media IDs into review submissions that are later deleted, attackers can destroy critical business assets—product images, logos, documents, and administrator-owned content—without authentication. This affects any WordPress installation using this widely-deployed e-commerce plugin, creating enterprise-wide data loss and availability risks.

Casky's 283 mapped skills detect the attack patterns underlying this vulnerability by analyzing both the Privilege Escalation (TA0004) and Credential Access (TA0006) attack chains. Practitioners using Casky would identify suspicious patterns: unauthenticated requests containing Media Library object IDs, review submission payloads with embedded file references, and deletion operations lacking proper authorization checks. Claude AI's extended reasoning capabilities correlate these indicators across the plugin's request handling, parameter validation, and permission verification layers—revealing where the authorization bypass occurs. Security teams would see findings pinpointing the missing access control checks, abnormal file deletion sequences triggered without authentication context, and patterns indicating potential systematic media library enumeration and destruction attempts.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-89055.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-89055

Casky has 283 skills that investigate the attack patterns behind CVE-2026-89055. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn