The Customer Reviews for WooCommerce plug-in discloses the email and IP addresses of review authors in versions up to 5.127.0. Visitors without an account can read them out character by character via the review search. The security vulnerability has the number CVE-2026-121518 and is listed in the American vulnerability database NVD.
The manufacturer CusRev closed the vulnerability in version 5.128.0, which has been in the WordPress plug-in directory since November 9. According to the directory, the plug-in has more than 80,000 active installations. WordPress only updates plug-ins on its own if you have turned on auto-updates for them. Without this switch, your shop keeps running the old version until you install the update by hand.
How does a visitor get the addresses?
The search accepts a term and returns the matching reviews. Behind the scenes, according to the NVD, WordPress also searches fields that it never shows publicly: the author's name, email address, web address and IP address. An attacker tries out one character after another and reads from the results list whether their fragment matches an address.
The NVD entry names the cause: Two AJAX actions of the plug-in, cr_show_more_all_reviews and cr_show_more_reviews, also run for visitors who are not logged in and do not check any authorization. The check via nonce, a one-time security key, only applies in the action for product pages if a filter is active that is switched off by default.
Wordfence reported the vulnerability and rated it medium at 5.3 out of 10. An attacker can only read and cannot change or delete anything. In the same entry, the CISA, the US cybersecurity agency, assesses the situation on November 13 as follows: attacks are not known so far, but the retrieval can be automated. A script can do it without manual work.
What does version 5.128.0 change?
According to the changelog, the version restricts the search in reviews as well as in questions and answers to public fields. In addition, the new version removes the configuration data of the tile view for reviews from the AJAX responses, so that the plug-in does not send submitted inputs back again. The previous version 5.127.0 already contained three other security fixes: it sanitizes slider settings, shows error messages of the tile view as plain text instead of HTML, and validates color values.
Version 5.128.0 requires PHP 7.4 or newer and, according to the plug-in page, is tested up to WordPress 7.1.4. If your server is still running an older PHP version, the PHP switch comes first.
What this means for you
It is best to open the plug-in list in the WordPress dashboard and search for Customer Reviews for WooCommerce. If a version up to 5.127.0 is listed there, install the update and turn on auto-updates for this plug-in.
How to check your shop in four steps
For sites with Customer Reviews for WooCommerce up to version 5.127.0
- VersionCheck in the plug-in list; from 5.128.0 the vulnerability is closed
- UpdateUpdate and turn on auto-updates for the plug-in
- LogCount requests to admin-ajax.php from the same address
- SuspicionCheck reporting obligation under Article 33 GDPR, warn customers
Steps 3 and 4 are the editorial team's assessment
Sources: NVD, WordPress.org, EUR-Lex
After that, it is worth looking at your server's access log. Watch for many requests to admin-ajax.php in a short time from the same address. A character-by-character query inevitably generates many requests. With POST requests, the search term is in the body of the request, which the usual server logs do not record. Then the number of requests remains the only indication. A clean log does not rule out a retrieval with certainty if your host has already deleted older entries.
If there are signs of a retrieval, personal data is involved, because email and IP addresses belong to it. Article 33 of the GDPR requires, in the event of a personal data breach, a notification to the supervisory authority within 72 hours after the breach became known to you, unless the breach is unlikely to result in a risk to the persons concerned. If you suspect a retrieval, it is best to get legal advice and warn your customers that emails in the name of your shop may be forged.
The NVD published the entry on November 13, 2026.
Sources
