A critical authorization bypass vulnerability in the Customer Reviews for WooCommerce plugin allows unauthenticated attackers to permanently delete sensitive media files, posing a severe risk to site integrity.

The vulnerability exists due to a missing authorization check (CWE-862) within the plugin's review handling logic. Unauthenticated attackers can leverage a public review form link to obtain a nonce and subsequently trigger the deletion of arbitrary attachments, including administrative assets, from the server Media Library.

The ability for an unauthenticated attacker to purge site media results in significant operational disruption and potential reputational damage. Given the CVSS score of 9.1, this represents a critical risk where an attacker can destroy essential product images, legal documents, or site branding, leading to site defacement and loss of trust with customers.

Immediate Action: Since a specific patched version is not confirmed, administrators should immediately deactivate the Customer Reviews for WooCommerce plugin until a security update is released by the vendor.

Proactive Monitoring: Review web server and WordPress access logs for anomalous requests directed at the review-form endpoints or unexpected deletion patterns in the Media Library.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized access to the plugin's AJAX handler endpoints until the vulnerability can be addressed via software update.

Public Exploit Available: Yes, a public proof-of-concept exists via a GitHub repository.

Due to the critical nature of this vulnerability and the ease of exploitation, immediate action is required. Organizations should prioritize the removal or deactivation of the affected plugin to prevent unauthorized data destruction. Monitor vendor channels for the release of a stable update and apply it immediately upon availability.