Customer Reviews for WooCommerce Unauthenticated Media Upload Vulnerability

A vulnerability exists in the Customer Reviews for WooCommerce WordPress plugin in versions prior to 5.113.0. The issue arises because the plugin does not implement authentication, capability, or nonce checks on a specific media upload AJAX action, when the review media attachment feature is activated. This flaw allows unauthenticated users to upload media files, limited to an allowed list of images and videos, to the Media Library. The uploaded files are then associated with attachment posts, leading to clutter in the media library and potential exhaustion of disk space.

Impact

Exploitation of this vulnerability results in unauthorized media uploads to the WordPress Media Library, creating attachment posts for the uploaded files. This not only pollutes the media library with unwanted content but can also cause a denial-of-service condition by exhausting available disk space through repeated uploads.

Reproduction

To reproduce this vulnerability, first ensure that the Customer Reviews for WooCommerce plugin is installed and activated, and that the review media attachment feature is enabled in the plugin's settings. Once these conditions are met, send an unauthenticated POST request to 'wp-admin/admin-ajax.php' with the action 'cr_upload_media', the 'cr_item' parameter set to a valid review item ID, and the 'cr_file' parameter containing the media file to be uploaded, such as an image or video. The response will include the ID of the newly created attachment post, confirming that the upload was successful without any authentication or permission checks.

Remediation

Users are advised to update the Customer Reviews for WooCommerce WordPress plugin to version 5.113.0 or later.