EUVD-2025-208928
GHSA-2c82-jh24-wvh5
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
3Description
The ReviewX - WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.12 via the syncedData function. This makes it possible for unauthenticated attackers to extract sensitive data including user names, emails, phone numbers, addresses.
Analysis
The ReviewX - WooCommerce Product Reviews plugin for WordPress contains a Sensitive Information Exposure vulnerability in the syncedData function that allows unauthenticated attackers to extract sensitive user data including names, emails, phone numbers, and addresses from affected sites. All versions up to and including 2.2.12 are vulnerable, affecting any WordPress installation running this popular review plugin. The vulnerability has a CVSS score of 5.3 (Medium) with low attack complexity and no authentication required, making it relatively straightforward to exploit.
Technical Context
The vulnerability exists in the DataSyncController.php REST endpoint handler (specifically the syncedData function), which improperly exposes sensitive user information without adequate access controls. This is classified under CWE-922 (Insecure Direct Object References / Improper Restriction of Rendered UI Layers by Untrusted Input), indicating that the plugin fails to properly validate or restrict which data objects unauthenticated users can access via REST API calls. The ReviewX plugin (identified via CPE: cpe:2.3:a:reviewx:reviewx_–_multi-criteria_reviews_for_woocommerce_with_google_reviews_&_schema) integrates with WooCommerce and WordPress REST APIs but does not enforce proper capability checks or nonce validation on the syncedData endpoint, allowing direct enumeration and extraction of customer personal information that should be protected.
Affected Products
The ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin in all versions up to and including 2.2.12 is vulnerable. The plugin is distributed via the WordPress plugin repository and is identified by CPE: cpe:2.3:a:reviewx:reviewx_–_multi-criteria_reviews_for_woocommerce_with_google_reviews_&_schema. Wordfence has published threat intelligence on this vulnerability with tracking ID eb830ad3-50ba-4dfe-becb-351b227706c1, and the vulnerable code has been confirmed in the DataSyncController.php file within version 2.2.7 and other versions in the same release cycle. Any WordPress site running the ReviewX plugin at version 2.2.12 or earlier is exposed to this data extraction attack.
Remediation
Update the ReviewX plugin immediately to the patched version released after 2.2.12 (consult the WordPress plugin repository or vendor advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/eb830ad3-50ba-4dfe-becb-351b227706c1 for the fixed version number). Until patching is possible, disable the ReviewX plugin entirely, or implement Web Application Firewall (WAF) rules to block unauthenticated REST API requests to the syncedData endpoint (/wp-json/reviewx/*). Additionally, audit WordPress access logs to detect any unauthorized data access attempts and consider notifying affected customers of potential data exposure in compliance with privacy regulations. Review WooCommerce customer data backups and consider implementing additional REST API authentication requirements site-wide.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today