What is the CVSS score of CVE-2025-10734?

CVE-2025-10734 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2025-10734?

Organizations using for WordPress is vulnerable to Sensitive Information Exposure in all should be aware of moderate risk from CVE-2025-10734 rated CVSS 5.3.

How to fix or mitigate CVE-2025-10734?

Within 30 days: Identify affected systems running for WordPress is vulnerable to Sensitive Information Exposur and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress CVE-2025-10734

EUVD-2025-208928 MEDIUM

Insecure Storage of Sensitive Information (CWE-922)

2026-03-23 Wordfence

GHSA-2c82-jh24-wvh5

WordPress Information Disclosure Google

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 23, 2026 - 05:45 euvd

EUVD-2025-208928

Analysis Generated

Mar 23, 2026 - 05:45 vuln.today

CVE Published

Mar 23, 2026 - 05:29 nvd

MEDIUM 5.3

DescriptionCVE.org

The ReviewX - WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.12 via the syncedData function. This makes it possible for unauthenticated attackers to extract sensitive data including user names, emails, phone numbers, addresses.

AnalysisAI

The ReviewX - WooCommerce Product Reviews plugin for WordPress contains a Sensitive Information Exposure vulnerability in the syncedData function that allows unauthenticated attackers to extract sensitive user data including names, emails, phone numbers, and addresses from affected sites. All versions up to and including 2.2.12 are vulnerable, affecting any WordPress installation running this popular review plugin. The vulnerability has a CVSS score of 5.3 (Medium) with low attack complexity and no authentication required, making it relatively straightforward to exploit.

Technical ContextAI

The vulnerability exists in the DataSyncController.php REST endpoint handler (specifically the syncedData function), which improperly exposes sensitive user information without adequate access controls. This is classified under CWE-922 (Insecure Direct Object References / Improper Restriction of Rendered UI Layers by Untrusted Input), indicating that the plugin fails to properly validate or restrict which data objects unauthenticated users can access via REST API calls. The ReviewX plugin (identified via CPE: cpe:2.3:a:reviewx:reviewx_–_multi-criteria_reviews_for_woocommerce_with_google_reviews_&_schema) integrates with WooCommerce and WordPress REST APIs but does not enforce proper capability checks or nonce validation on the syncedData endpoint, allowing direct enumeration and extraction of customer personal information that should be protected.

RemediationAI

Update the ReviewX plugin immediately to the patched version released after 2.2.12 (consult the WordPress plugin repository or vendor advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/eb830ad3-50ba-4dfe-becb-351b227706c1 for the fixed version number). Until patching is possible, disable the ReviewX plugin entirely, or implement Web Application Firewall (WAF) rules to block unauthenticated REST API requests to the syncedData endpoint (/wp-json/reviewx/*). Additionally, audit WordPress access logs to detect any unauthorized data access attempts and consider notifying affected customers of potential data exposure in compliance with privacy regulations. Review WooCommerce customer data backups and consider implementing additional REST API authentication requirements site-wide.