---
id: CVE-2026-8615
title: >-
  ilGhera Reviso Exporter for WooCommerce <= 1.2.3 - Missing Authorization to
  Authenticated (Subscriber+) Agreement Grant Token Deletion via
  disconnect_callback Function
summary: >-
  The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to
  unauthorized modification of data due to a missing capability check and
  missing nonce verification on the disconnect_callback() function in versions
  up to, and inc…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: ghera74
product: ilGhera Reviso Exporter for WooCommerce
affected:
  - ilghera_reviso_exporter_for_woocommerce <= 1.2.3
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-11T20:10:33.684038Z'
published: '2026-09-09'
updated: '2026-09-11'
sourceUpdated: '2026-09-11T20:19:14.384Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-8615'
references:
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/894ef079-8c57-4e69-94a9-0be71f2f6176?source=cve
  - url: >-
      https://plugins.trac.wordpress.org/browser/wc-exporter-for-reviso/tags/1.2.3/includes/class-wcefr-settings.php#L87
  - url: >-
      https://plugins.trac.wordpress.org/browser/wc-exporter-for-reviso/tags/1.2.3/includes/class-wcefr-settings.php#L22
  - url: >-
      https://github.com/ilGhera/wc-exporter-for-reviso/commit/26ef890d596a77ca66ffc15c60b8f806dbf2d4d2
tags:
  - cve.org
epss: 0.00336
epssPercentile: 0.24225
ingestedAt: '2026-09-14T11:11:19.882Z'
---

## Overview

The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the disconnect_callback() function in versions up to, and including, 1.2.3. The function is registered to the 'wp_ajax_wcefr-disconnect' AJAX action and unconditionally calls delete_option('wcefr-agt'), which removes the Reviso Agreement Grant Token used to authenticate API calls. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's stored Agreement Grant Token, breaking the connection between WooCommerce and the Reviso service.

## Affected

- `ilghera_reviso_exporter_for_woocommerce <= 1.2.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.