CVE-2026-14941

MediumCVSS 5.4/10Last modified Aug 26, 2026

Description

The Customer Reviews for WooCommerce WordPress plugin before 5.116.0 does not perform nonce or capability checks on several settings-related AJAX actions, allowing users with minimal permissions such as Subscribers to invoke administrative settings handlers, update Customer Reviews for WooCommerce WordPress plugin before 5.116.0 options, and disclose store configuration.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Aug 10, 2026
Last modified: Aug 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-149437.5The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict RES CVE-2026-149467.2A high privileged remote attacker can upload a .php file and then request it directly from /uploads/<filename>.php to achieve arbitrary code CVE-2026-149477.2A high-privileged remote attacker can upload malicious ZIP archive containing directory traversal sequences such as ../ can escape the inten CVE-2026-149488.8A low privileged remote attacker can hijack an active administrative session without needing to know the administrator password by extractin CVE-2026-149496.5A low privileged remote attacker with a valid session can submit a request to the user creation functionality exposed through /api/user/add.CVE-2026-14956.5The vulnerability, if exploited, could allow an attacker with Event Log Reader (S-1-5-32-573) privileges to obtain proxy details, including CVE-2026-149509.8An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have ex CVE-2026-149518.0An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web p CVE-2026-149527.5An unauthenticated remote attacker can retrieve sensible files from the FDS Web server, such as the backup archive at /FdsBackup.zip and add CVE-2026-149534.3A low-privileged remote attacker can enumerate all configured users and identify which accounts hold elevated privileges using the endpoint CVE-2026-149556.5The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and includi CVE-2026-149569.8The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.8.6. This is due to imp