4.3
Medium
CVE-2024-3243 The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized email sending due to a missing…
Description
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the send_test_email() function in all versions up to, and including, 5.46.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to send arbitrary test emails.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Customer Reviews for WooCommerce 5.46 | earliest → 5.46.0 | No fix stated |
| customer_reviews_for_woocommerce 5.46 | earliest → 5.46.0 | No fix stated |
Other CVEs of Customer Reviews for WooCommerce
The 16 CVEs of Customer Reviews for WooCommerce →
CVE-2026-120553
Customer Reviews for WooCommerce <= 5.126.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slides_to_show' Shortcode Attribute
6.4
Medium
CVE-2026-97663
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment…
7.2
High
CVE-2026-89055
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to,…
9.1
Critical
CVE-2026-6176
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…
7.2
High