What is CVE-2026-14941?
The Customer Reviews for WooCommerce WordPress plugin before version 5.116.0 lacks nonce and capability checks on several AJAX settings actions, allowing low-privileged users like Subscribers to invoke administrative handlers and modify plugin settings. Immediate plugin update is required to mitigate this vulnerability.
Azərbaycanca: "Customer Reviews for WooCommerce" WordPress plaginin 5.116.0 versiyasından əvvəlki versiyalarında bəzi AJAX əməliyyatlarında nonce və ya səlahiyyət yoxlaması aparılmır. Bu, Subscriber kimi aşağı icazəli istifadəçilərə inzibati parametrləri dəyişməyə imkan verir. Plagin dərhal ən son versiyaya yenilənməlidir.
Related CVEs
link basis: same weakness class CWE-862
FAQ2
Which versions of the Customer Reviews for WooCommerce plugin are affected by CVE-2026-14941?
The vulnerability affects all versions of the plugin before 5.116.0.
What can a low-privileged user do by exploiting CVE-2026-14941?
Low-privileged users like Subscribers can invoke administrative handlers and modify plugin settings.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.