CVE-2026-8615ilGhera Reviso Exporter for WooCommerce <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token Deletion via disconnect_callback Function
Updated under an hour ago ()
Does this affect you?
It affects ghera74 ilGhera Reviso Exporter for WooCommerce. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the disconnect_callback() function in versions up to, and including, 1.2.3. The function is registered to the 'wp_ajax_wcefr-disconnect' AJAX action and unconditionally calls delete_option('wcefr-agt'), which removes the Reviso Agreement Grant Token used to authenticate API calls. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's stored Agreement Grant Token, breaking the connection between WooCommerce and the Reviso service.
- CVSS
- 4.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness (CWE)
- CWE-862
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Wordfence
- NVD analysis
- Deferred
- Record last updated
- Sep 11, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
ghera74 ilGhera Reviso Exporter for WooCommerce ghera74:ilghera_reviso_exporter_for_woocommerce (from the name) | through 1.2.3 | CNA record |
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/894ef079-8c57-4e69-94a9-0be71f2f6176?source=cve
- https://plugins.trac.wordpress.org/browser/wc-exporter-for-reviso/tags/1.2.3/includes/class-wcefr-settings.php#L87
- https://plugins.trac.wordpress.org/browser/wc-exporter-for-reviso/tags/1.2.3/includes/class-wcefr-settings.php#L22
- https://github.com/ilGhera/wc-exporter-for-reviso/commit/26ef890d596a77ca66ffc15c60b8f806dbf2d4d2
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.