The Common Vulnerabilities and Exposures (CVE) system has recently assigned a unique identifier of CVE-2023-45101 to a critical security vulnerability found in the Customer Reviews for WooCommerce plugin. This vulnerability, classified as a Missing Authorization issue, allows unauthorized users to exploit the plugin's core functionalities, potentially leading to the compromise of sensitive data or unauthorized access to critical customer information.

This vulnerability concerns WooCommerce installations running older versions of CusRev Customer Reviews for WooCommerce plugin – specifically, versions prior to 5.36.. Upgrading to version 5.36. and above eliminates the vulnerability, so it is recommended that users immediately update their plugin to the latest version.

Vulnerability Details

The Customer Reviews for WooCommerce plugin allows online stores to collect customer reviews and display them on their website. The plugin features a variety of tools and options for managing and customizing customer feedback.

A thorough security analysis of the plugin revealed a significant Missing Authorization issue, which occurs due to improper implementation of access control security levels. As a result, an attacker with some knowledge of the underlying system could potentially exploit this vulnerability by gaining unauthorized access to critical plugin functions, which could, in turn, lead to unauthorized data access or even complete control of the WooCommerce store.

This vulnerability potentially allows an attacker to complete the following actions without the appropriate permissions:

Relevant Code Snippet

The vulnerability lies in the plugin's handling of AJAX calls to certain internal functions. Below is an example of a vulnerable code snippet from previous versions of the plugin:

add_action('wp_ajax_nopriv_cusrev_import_reviews', 'import_reviews_ajax_callback');

This line of code enables AJAX functionality for the "cusrev_import_reviews" action without checking if the user has the necessary permissions to perform this action.

Solution and Mitigation

The plugin's developers have addressed this vulnerability in version 5.36. of the Customer Reviews for WooCommerce plugin. Users are strongly urged to upgrade their plugin to this version to protect their store from unauthorized access and potential exploitation.

Find the "Customer Reviews for WooCommerce" plugin in the list and click "Update Now."

In addition, strengthening access control measures for the entire WordPress installation will help protect it from other potential threats. For example, implementing two-factor authentication, employing strong and unique passwords, and regularly applying security updates to your site can drastically improve your overall security posture.

Original References and Further Reading

1. CVE-2023-45101 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45101
2. Vulnerability announcement - https://wpvulndb.com/vulnerabilities/11202
3. Customer Reviews for WooCommerce - https://wordpress.org/plugins/customer-reviews-woocommerce/
4. WordPress Access Control Best Practices - https://wordpress.org/support/article/roles-and-capabilities/

Conclusion

Missing Authorization vulnerabilities such as the one identified in the Customer Reviews for WooCommerce plugin (CVE-2023-45101), can lead to unauthorized access, data breaches, and potentially severe consequences for your online store. By promptly updating the plugin to the latest version and implementing strong access control measures across your entire WordPress installation, you can help to secure your site and protect your customers' sensitive information.

Timeline

Published on: 01/02/2025 12:15:08 UTC