Commit 4628e9711e0 for woocommerce

commit 4628e9711e0d93bbdcd1081d13d5c0706fd318e0
Author: Albert Juhé Lluveras <contact@albertjuhe.com>
Date:   Mon Nov 2 10:38:22 2026 +0100

    Store API reviews endpoint: include avatars data only if they are enabled on the site (#70514)

    * Store API reviews endpoint: include avatars data only if they are enabled on the site

    * Add changelog

diff --git a/plugins/woocommerce/changelog/fix-WOO6-390-no-avatars-reviews-response b/plugins/woocommerce/changelog/fix-WOO6-390-no-avatars-reviews-response
new file mode 100644
index 00000000000..b14ed4e197f
--- /dev/null
+++ b/plugins/woocommerce/changelog/fix-WOO6-390-no-avatars-reviews-response
@@ -0,0 +1,4 @@
+Significance: patch
+Type: fix
+
+Store API reviews endpoint: include avatars data only if they are enabled on the site
diff --git a/plugins/woocommerce/src/StoreApi/Schemas/V1/ProductReviewSchema.php b/plugins/woocommerce/src/StoreApi/Schemas/V1/ProductReviewSchema.php
index b1242213309..f49266785db 100644
--- a/plugins/woocommerce/src/StoreApi/Schemas/V1/ProductReviewSchema.php
+++ b/plugins/woocommerce/src/StoreApi/Schemas/V1/ProductReviewSchema.php
@@ -160,7 +160,7 @@ class ProductReviewSchema extends AbstractSchema {
 	 */
 	public function get_item_response( $review ) {
 		$rating = get_comment_meta( $review->comment_ID, 'rating', true ) === '' ? null : (int) get_comment_meta( $review->comment_ID, 'rating', true );
-		return [
+		$data   = [
 			'id'                     => (int) $review->comment_ID,
 			'date_created'           => wc_rest_prepare_date_response( $review->comment_date ),
 			'formatted_date_created' => get_comment_date( 'F j, Y', $review->comment_ID ),
@@ -173,7 +173,12 @@ class ProductReviewSchema extends AbstractSchema {
 			'review'                 => wpautop( $review->comment_content ),
 			'rating'                 => $rating,
 			'verified'               => wc_review_is_from_verified_owner( $review->comment_ID ),
-			'reviewer_avatar_urls'   => rest_get_avatar_urls( $review->comment_author_email ),
 		];
+
+		if ( get_option( 'show_avatars' ) ) {
+			$data['reviewer_avatar_urls'] = rest_get_avatar_urls( $review->comment_author_email );
+		}
+
+		return $data;
 	}
 }
diff --git a/plugins/woocommerce/tests/php/src/Blocks/StoreApi/Routes/ProductReviews.php b/plugins/woocommerce/tests/php/src/Blocks/StoreApi/Routes/ProductReviews.php
index d1e40e86afd..ee9802e1433 100644
--- a/plugins/woocommerce/tests/php/src/Blocks/StoreApi/Routes/ProductReviews.php
+++ b/plugins/woocommerce/tests/php/src/Blocks/StoreApi/Routes/ProductReviews.php
@@ -84,6 +84,25 @@ class ProductReviews extends ControllerTestCase {
 		$this->assertSame( 5, $data[1]['rating'] );
 	}

+	/**
+	 * @testdox Reviewer avatar URLs are neither declared nor returned when avatars are disabled.
+	 */
+	public function test_reviewer_avatar_urls_are_omitted_when_avatars_are_disabled(): void {
+		update_option( 'show_avatars', '0' );
+
+		$response = rest_get_server()->dispatch( new \WP_REST_Request( 'GET', '/wc/store/v1/products/reviews' ) );
+		$data     = $response->get_data();
+		$schema   = rest_get_server()->dispatch( new \WP_REST_Request( 'OPTIONS', '/wc/store/v1/products/reviews' ) )->get_data()['schema'];
+
+		$this->assertSame( 200, $response->get_status() );
+		$this->assertCount( 2, $data );
+		$this->assertArrayNotHasKey( 'reviewer_avatar_urls', $schema['properties'] );
+		foreach ( $data as $review ) {
+			$this->assertArrayNotHasKey( 'reviewer_avatar_urls', $review );
+		}
+		$this->assertStringNotContainsString( hash( 'sha256', 'woo@woo.local' ), wp_json_encode( $data ) );
+	}
+
 	/**
 	 * @testdox Reviews are only returned for published products.
 	 */