What is CVE-2024-1044?

CVE-2024-1044 is a medium-severity vulnerability in Cusrev Customer Reviews For Woocommerce, classified under Improper Access Control. CVSS score: 5.3/10. Published 2024-02-29.

How severe is CVE-2024-1044?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Is CVE-2024-1044 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Cusrev Customer Reviews For Woocommerce

CVE-2024-1044

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submit_review' function in all versions up to, and including, 5.38.12. This makes it possible for unauthenticated attackers to submit reviews with arbitrary email addresses regardless of whether reviews are globally enabled.

EPSS: 0.004 (33.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.

Affected products

Cusrev Customer_reviews_for_woocommerce
Ivole Customer Reviews For Woocommerce — versions 0

Weakness classification (CWE)

Public proof-of-concept exploits

20142995/nuclei-templates

References

security@wordfence.com (Third Party Advisory)
security@wordfence.com (Product)

Frequently asked questions

What is CVE-2024-1044?: CVE-2024-1044 is a medium-severity vulnerability in Cusrev Customer Reviews For Woocommerce, classified under Improper Access Control. CVSS score: 5.3/10. Published 2024-02-29.
How severe is CVE-2024-1044?: Medium severity. CVSS v3 base score is 5.3 out of 10.
Is CVE-2024-1044 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.