# Yotpo: Product & Photo Reviews for WooCommerce < 1.8.3 - Cross-Site Request Forgery via Sync Widget IDs, Submit Past Orders and Export Reviews Actions

- **ID:** WPSEC-2026-0792
- **Plugin:** Yotpo Product Reviews (`yotpo-social-reviews-for-woocommerce`), https://wordpress.org/plugins/yotpo-social-reviews-for-woocommerce/
- **Affected versions:** all versions before 1.8.3
- **Fixed in:** 1.8.3 (Update to 1.8.3 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-352
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/yotpo-social-reviews-for-woocommerce
- **Fix released:** 2026-10-08
- **Published:** 2026-10-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0792/

## Description

The Yotpo Product Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions prior to 1.8.3 due to missing nonce validation on the Sync widget IDs, Submit past orders and Export reviews actions. This makes it possible for unauthenticated attackers to trigger widget ID synchronization, submission of past orders to Yotpo, or a review export via a forged request, provided they can trick a site administrator into performing an action such as clicking a link.

## References

- https://wpsec.com/vuln/WPSEC-2026-0792/
- https://plugins.svn.wordpress.org/yotpo-social-reviews-for-woocommerce/tags/1.8.3/
- https://wordpress.org/plugins/yotpo-social-reviews-for-woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0792/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.