Vulnerabilities / Yotpo: Product & Photo Reviews for WooCommerce / WPSEC-2026-0792
Yotpo: Product & Photo Reviews for WooCommerce < 1.8.3 - Cross-Site Request Forgery via Sync Widget IDs, Submit Past Orders and Export Reviews Actions
Medium 4.3
CWE-352Fixed in 1.8.3
- ID
- WPSEC-2026-0792
- Plugin
- Yotpo Product Reviews (yotpo-social-reviews-for-woocommerce)
- Affected
- all versions before 1.8.3
- Remediation
- Update to 1.8.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- Weakness
- CWE-352
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-12
- Attack surface
- Yotpo: Product & Photo Reviews for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Yotpo Product Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions prior to 1.8.3 due to missing nonce validation on the Sync widget IDs, Submit past orders and Export reviews actions. This makes it possible for unauthenticated attackers to trigger widget ID synchronization, submission of past orders to Yotpo, or a review export via a forged request, provided they can trick a site administrator into performing an action such as clicking a link.
References
- https://wpsec.com/vuln/WPSEC-2026-0792/
- https://plugins.svn.wordpress.org/yotpo-social-reviews-for-woocommerce/tags/1.8.3/
- https://wordpress.org/plugins/yotpo-social-reviews-for-woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS