EUVD-2025-208926
GHSA-vf78-px8h-wm3v
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
3Description
The ReviewX - WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.12 via the allReminderSettings function. This makes it possible for unauthenticated attackers to obtain authentication tokens and subsequently bypass admin restrictions to access and export sensitive data including order details, names, emails, addresses, phone numbers, and user information.
Analysis
The ReviewX WordPress plugin for WooCommerce contains an unauthenticated sensitive information exposure vulnerability in the allReminderSettings function that allows attackers to obtain authentication tokens and bypass admin restrictions. Affected versions up to 2.2.12 expose critical customer data including order details, names, emails, addresses, phone numbers, and user information. With a CVSS score of 5.3 and network-based attack vector requiring no authentication or user interaction, this vulnerability poses a moderate but immediate risk to any WordPress installation using the plugin.
Technical Context
The vulnerability stems from inadequate access control in the REST API middleware, specifically in the allReminderSettings function which is exposed via the EmailTemplateController and protected by the AdminMiddleware. The root cause is classified under CWE-285 (Improper Authorization), indicating that the AdminMiddleware fails to properly validate authentication tokens before exposing sensitive endpoints. The DataSyncController further compounds this issue by allowing data export without proper privilege verification. The ReviewX plugin (cpe:2.3:a:reviewx:reviewx_–_multi-criteria_reviews_for_woocommerce_with_google_reviews_&_schema:*:*:*:*:*:*:*:*) integrates with WooCommerce's REST API but does not implement sufficient nonce verification or capability checks, allowing unauthenticated actors to interact with admin-level functions.
Affected Products
The ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable in all versions up to and including 2.2.12, as identified via CPE (cpe:2.3:a:reviewx:reviewx_–_multi-criteria_reviews_for_woocommerce_with_google_reviews_&_schema:*:*:*:*:*:*:*:*). The vulnerability was reported by Wordfence and affects installations running version 2.2.12 or earlier. WordPress sites with this plugin installed should immediately check their installed version against the patched release. Code review of vulnerable versions (2.2.7 confirmed via plugin repository references) shows the defect in the REST endpoints: EmailTemplateController.php line 165, AdminMiddleware.php line 11, and DataSyncController.php line 68.
Remediation
Update the ReviewX plugin to version 2.2.13 or later immediately, as patches have been released by the vendor to address the unauthenticated access issue in the allReminderSettings function. Visit the WordPress plugin repository and apply the update through the WordPress admin dashboard (Plugins > Installed Plugins > ReviewX > Update, or via automatic updates if enabled). As an interim measure before patching is possible, implement IP-based access controls to restrict REST API endpoints to trusted administrative networks, and consider disabling the ReviewX plugin temporarily if it is not actively required. Additionally, audit WooCommerce and WordPress access logs (especially requests to /wp-json/ endpoints containing 'reminder' or 'datasync' parameters) to identify potential exploitation. For sites that cannot immediately patch, disable REST API access for unauthenticated users via a security plugin or .htaccess rules targeting wp-json endpoints.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today