{"id":"CVE-2026-100517","published":"2026-10-01T15:17:17.810","lastModified":"2026-10-01T20:31:55.537","description":"Unauthenticated Insecure Direct Object References (IDOR) in Photo Reviews for WooCommerce <= 1.2.30 versions.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-639"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/woo-photo-reviews/vulnerability/wordpress-photo-reviews-for-woocommerce-plugin-1-2-30-insecure-direct-object-references-idor-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"An unauthenticated IDOR vulnerability allows attackers to access photo review data that should be restricted, potentially leading to unauthorized access to sensitive user-generated content and review information.","exploitability":"Exploitation is straightforward with no authentication required, though it may need knowledge of specific object identifiers to target particular reviews.","blast_radius":"The impact could be significant as attackers can access all photo reviews across the WooCommerce store without needing credentials, potentially exposing sensitive user feedback and review data.","remediation":"Upgrade to Photo Reviews for WooCommerce version 1.2.31 or later to address this IDOR vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["idor","woocommerce","web"],"model":"garnet-coder","analyzedAt":"2026-10-13T09:05:23.878Z"}}