tadrik Free store check

Plugin security / Customer Reviews for WooCommerce

Customer Reviews for WooCommerce vulnerability: is your WooCommerce store affected?

Customer Reviews for WooCommerce has 7 serious security holes rated 7 or higher out of 10 that someone can use with no login or with only a customer account. The newest was published on 24 September 2026. Every one is fixed: update to 5.123.0 or newer.

Short answer: your store is affected if it runs Customer Reviews for WooCommerce older than 5.123.0. Update to 5.123.0 or newer, on a copy of the store first if you can.

In our check of 3,600 live UK and US WooCommerce stores (31 October 2026 to 1 November 2026), 21 were running a version of Customer Reviews for WooCommerce with a serious hole that already had a fix. How we checked.

The security holes

Newest first. Each one is published in a public security database and fixed in the version shown.

  1. Deletion

    Someone could delete content or files, which can take the store down.

    Score 7.5 (high)no login neededAffected: older than 5.121.0Fixed in 5.121.0Published 24 September 2026CVE-2026-96823

    Advisory: Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce <= 5.120.0 versions.

  2. Cross-site scripting

    Someone could plant a script that runs in your visitors' or your admins' browsers.

    Score 7.2 (high)no login neededAffected: older than 5.123.0Fixed in 5.123.0Published 24 September 2026CVE-2026-97663

    Advisory: The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 5.122.0 due to insufficient input sanitization and...

  3. Missing permission check

    An action that should need permission could be done without it.

    Score 9.1 (critical)no login neededAffected: older than 5.121.0Fixed in 5.121.0Published 31 August 2026CVE-2026-89055

    Advisory: The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.120.0.

  4. Cross-site scripting

    Someone could plant a script that runs in your visitors' or your admins' browsers.

    Score 7.2 (high)no login neededAffected: older than 5.107.0Fixed in 5.107.0Published 6 August 2026CVE-2026-6176

    Advisory: The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the aggregated review form submission in versions up to and including 5.106.0.

  5. Cross-site scripting

    Someone could plant a script that runs in your visitors' or your admins' browsers.

    Score 7.1 (high)no login neededAffected: older than 5.111.0Fixed in 5.111.0Published 24 June 2026CVE-2026-56043

    Advisory: Unauthenticated Cross Site Scripting (XSS) in Customer Reviews for WooCommerce <= 5.110.1 versions.

  6. File upload

    Someone could upload files to your server, which can include code.

    Score 8.8 (high)needs only a customer accountAffected: older than 5.38.10Fixed in 5.38.10Published 9 January 2024CVE-2023-6979

    Advisory: The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ivole_import_upload_csv AJAX action in all versions up to, and including,...

  7. File access

    Someone could read files on your server they should never see.

    Score 8.8 (high)needs only a customer accountAffected: older than 5.16.0Fixed in 5.16.0Published 23 January 2023CVE-2023-0080

    Advisory: The Customer Reviews for WooCommerce WordPress plugin before 5.16.0 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary files via a...

How to check your version

  1. Log in to WordPress and open Plugins > Installed Plugins.
  2. Find Customer Reviews for WooCommerce. The version number is under its name. If it is lower than 5.123.0, your store is affected.
  3. No login to hand? Open https://yourstore.com/wp-content/plugins/customer-reviews-woocommerce/readme.txt in a browser, with your own address in place of yourstore.com, and read the Stable tag line. Some hosts block this file; then use step 1.

How to fix it

  1. Make a backup, or better, a staging copy of the store (most hosts have a one-click staging button).
  2. On the copy, update Customer Reviews for WooCommerce to 5.123.0 or newer: Dashboard > Updates, or Update now on the Plugins page.
  3. If no update shows, it may be a paid version whose licence has run out: download the new version from the seller's site and upload it.
  4. Place a test order on the copy: add to cart, check out, pay with a test method. Check the pages that use Customer Reviews for WooCommerce.
  5. If everything works, make the same update on the live store and place one more test order.
  6. If you no longer use Customer Reviews for WooCommerce, delete it instead of leaving it deactivated.

Not sure, or no time?

Get a free check of your store: we look at its public pages for plugins with known holes, and reply within one working day. Or we fix it for you: we update your store on a copy, place a test order, and only then change the live store, for a fixed £99 / $119.

Free store check Fix it for me on a copy

Questions

Which Customer Reviews for WooCommerce version fixes it?
Version 5.123.0 or newer fixes all 7 issues on this page.
How do I know if my store is affected?
Your store is affected if it runs Customer Reviews for WooCommerce older than 5.123.0. In WordPress, open Plugins and read the version under Customer Reviews for WooCommerce. Without logging in, open yourstore.com/wp-content/plugins/customer-reviews-woocommerce/readme.txt and read the Stable tag line.
I don't use Customer Reviews for WooCommerce any more. Is a deactivated copy safe?
Deactivating it lowers the risk but leaves the old code on your server. If you don't use it, delete it; if you do, update it.
Can someone fix it for me?
Yes. We update the store on a copy first, place a test order, and only then make the same change on the live store, for a fixed price.

Vulnerability data: WPVulnerability (wpvulnerability.net, CC0), which links each entry to its CVE or advisory. Store numbers: Tadrik's own checks of public pages, aggregates only. Page updated 3 November 2026.