CVE-2026-14941CWE-862broken-access-control

CVE-2026-14941

Medium · published August 10, 2026

CVSS v3.1

5.4

EPSS

Percentile

13.1

In the wild

Unconfirmed

What it is

The Customer Reviews for WooCommerce WordPress plugin before 5.116.0 does not perform nonce or capability checks on several settings-related AJAX actions, allowing users with minimal permissions such as Subscribers to invoke administrative settings handlers, update Customer Reviews for WooCommerce WordPress plugin before 5.116.0 options, and disclose store configuration.

The record

Technical detail

CVSS v3.1: 5.4 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00230 · 13.1th percentile
Weakness: CWE-862 · Missing Authorization
Published: 2026-08-10T11:16Z

References (1)

https://wpscan.com/vulnerability/572ba4a2-1b51-4631-9c28-7cc3d44f0761/ · [email protected]

EPSS history

Timeline

10 AUG 06:00Z
Customer Reviews for WooCommerce < 5.116.0 - Subscriber+ Missing Authorization via Multiple Settings AJAX Actions
cvelistv5