CVE-2026-24562: 
WordPress vulnerability analysis and mitigation

CVE-2026-24562 is a Missing Authorization (Broken Access Control) vulnerability in the Ryviu – Product Reviews for WooCommerce WordPress plugin. It allows unauthenticated remote attackers to exploit incorrectly configured access control security levels, potentially performing unauthorized privileged actions. The vulnerability affects all plugin versions through 3.1.27, and was disclosed on January 22–23, 2026, by researcher Legion Hunter via Patchstack. It carries a CVSS v3.1 base score of 5.3 (Medium), assigned by Patchstack (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning one or more plugin functions fail to verify whether the requesting user has the appropriate permissions before executing privileged operations. This is a network-accessible flaw requiring no authentication, no user interaction, and low attack complexity, consistent with OWASP Top 10 category A1: Broken Access Control. The specific function(s) lacking proper nonce token or capability checks have not been publicly detailed beyond the Patchstack advisory, which credits Legion Hunter with discovery on December 23, 2025 (Patchstack).

Successful exploitation allows an unauthenticated attacker to perform actions that should be restricted to higher-privileged users, resulting in a low integrity impact with no confidentiality or availability impact per the CVSS scoring. In practice, this could allow unauthorized modification of plugin data, review manipulation, or other unauthorized write operations on affected WooCommerce stores. While the individual impact is limited, Patchstack notes that vulnerabilities of this type are frequently used in mass-exploit campaigns targeting thousands of WordPress sites simultaneously (Patchstack).

No public proof-of-concept exploit code has been identified for this vulnerability. The EPSS score is very low at approximately 0.009%, indicating a low probability of exploitation in the near term (Red Hat CVE). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no in-the-wild exploitation or threat actor attribution has been reported. However, Patchstack warns that broken access control vulnerabilities in WordPress plugins are commonly targeted in automated mass-scanning campaigns (Patchstack).

As of the time of disclosure, no official patched version of the Ryviu – Product Reviews for WooCommerce plugin has been released; the Patchstack advisory notes "No official patch available" for versions through 3.1.27. Site administrators should monitor the WordPress plugin repository for an updated version and apply it immediately upon release. In the interim, disabling or removing the plugin is the most effective workaround. Patchstack subscribers may benefit from virtual patching protection provided by the Patchstack firewall (Patchstack).