{"affected":[{"defaultStatus":"unaffected","product":"Customer Reviews for WooCommerce","source":"CNA: Wordfence","vendor":"ivole","versions":[{"lessThanOrEqual":"5.127.0","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-121518","cwes":["CWE-200"],"description":"The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 5.127.0 via the 'search' parameter of the cr_show_more_all_reviews and cr_show_more_reviews AJAX actions. This is due to the handlers being hooked on wp_ajax_nopriv_* without a capability check (and, in the product-page handler, with a nonce check that is behind a filter defaulting to false) while passing the visitor-supplied search string straight into get_comments() as the 'search' argument, which core expands into LIKE conditions over comment_author, comment_author_email, comment_author_url, comment_author_IP and comment_content. This makes it possible for unauthenticated attackers to extract review author email addresses and IP addresses — fields WordPress and WooCommerce never expose to the public — one character at a time by observing whether the returned result set matches a probed substring.","epss":{"date":"2026-11-13","percentile":0.48042,"score":0.00576},"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: Wordfence","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},{"score":5.3,"severity":"medium","source":"NVD: security@wordfence.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}],"modifiedAt":1794611833783,"publishedAt":1794562516266,"references":[{"source":"CNA: Wordfence","tags":[],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e93acf29-8ff0-4412-9ff0-161f154b4311?source=cve"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/blocks/class-cr-all-reviews.php#L26"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/blocks/class-cr-all-reviews.php#L584"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/blocks/class-cr-all-reviews.php#L407"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/reviews/class-cr-ajax-reviews.php#L24"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/reviews/class-cr-ajax-reviews.php#L284"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/reviews/class-cr-ajax-reviews.php#L159"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/reviews/class-cr-ajax-reviews.php#L175"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/changeset/3791702/"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/changeset/3791702/customer-reviews-woocommerce/trunk/includes/blocks/class-cr-all-reviews.php"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/blocks/class-cr-all-reviews.php#L26"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/blocks/class-cr-all-reviews.php#L407"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/blocks/class-cr-all-reviews.php#L584"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/reviews/class-cr-ajax-reviews.php#L159"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/reviews/class-cr-ajax-reviews.php#L175"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/reviews/class-cr-ajax-reviews.php#L24"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/reviews/class-cr-ajax-reviews.php#L284"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/changeset/3791702/"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/changeset/3791702/customer-reviews-woocommerce/trunk/includes/blocks/class-cr-all-reviews.php"},{"source":"security@wordfence.com","tags":[],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e93acf29-8ff0-4412-9ff0-161f154b4311?source=cve"}],"remediation":[],"revision":"f72974a8bed171497f0d55226a581619936ab2a389da99cd780194e21186b383","sources":[{"modifiedAt":1794609027099,"name":"CNA: Wordfence","retrievedAt":1794611306110,"url":"https://www.cve.org/CVERecord?id=CVE-2026-121518"},{"modifiedAt":1794611833783,"name":"NVD","retrievedAt":1794615498106,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121518"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794611327306,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-121518"}],"ssvc":{"assessedAt":1794587668532,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Customer Reviews for WooCommerce <= 5.127.0 - Unauthenticated Sensitive Information Exposure in 'search' Parameter","updatedAt":1794615498106}