CVE-2026-101923

{
  "etk_id": "ETK-2026-423",
  "cve_id": "CVE-2026-101923",
  "display_id": "CVE-2026-101923",
  "ghsa_id": "GHSA-24v8-rv6x-cqwg",
  "euvd_id": "EUVD-2026-91909",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Arbitrary content deletion in Photo Reviews for WooCommerce",
  "summary": "Photo Reviews for WooCommerce versions through 1.2.30 can permit unauthenticated attackers to cause deletion of WordPress posts, pages, products, or media. Exploitation requires the attacker to submit a public review and for that review to later be deleted by an administrator or automated comment cleanup.",
  "mitigation": "Disable the plugin or disable public review submissions until the vendor provides an update. Review and restrict who can submit reviews, and monitor review deletion activity for unexpected content removal.",
  "vendor": "villatheme",
  "product": "Photo Reviews for WooCommerce",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.2.30"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Photo Reviews for WooCommerce",
      "purl": null
    }
  ],
  "cwes": [
    862
  ],
  "cvss_score": 8.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
  "epss_score": 0.0034,
  "epss_percentile": 0.2625,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 57.83963706666667,
  "t0_at": "2026-10-03T05:29:17.225000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-03T05:29:17.225000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-03T05:29:17.225000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101923"
    }
  }
}