Grav Star Ratings CVE-2026-109323

Exploitable only against Grav sites running the Star Ratings plugin versions 2.0.1 through 2.0.3 where vote access or read-only restrictions are relied upon - because enforcement is client-side only, the server accepts votes from any anonymous visitor using the nonce that getData() already emits publicly. No authentication, no user interaction, and no non-default configuration are required to call addVote(). The practical limiting factors are narrow: the target must deploy this specific plugin in the affected version range, and the impact ceiling is restricted to vote/rating data integrity - there is no path to confidentiality or availability compromise, which sharply bounds realistic risk.

This is a genuine but low-impact authorization flaw whose severity signals are internally consistent rather than conflicting. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) correctly describes a network-reachable, unauthenticated, low-complexity attack requiring no user interaction, and it scopes impact narrowly to integrity (VC:N/VI:L/VA:N) - no data disclosure and no availability loss. The 6.9 (Medium) score is therefore driven almost entirely by trivial reachability, not by consequence: the only thing an attacker can corrupt is rating/vote data. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization; exploitation ease is high but real-world motivation is low because the payoff is limited to skewing star ratings. The core attack mechanics are confirmed by the GitHub Security Advisory (GHSA-556j-6jh2-5rcv) and VulnCheck, but no exploitation-probability data is available to refine likelihood. Net: prioritize as a data-integrity/abuse-prevention fix, not an emergency; this is a legitimately low-real-risk issue despite the Medium score.

An attacker observes the anonymous nonce that the plugin's getData() emits to ordinary page visitors, then issues direct HTTP POST requests to the addVote() endpoint without authenticating. By replaying this against ratings that are supposed to be read-only or access-restricted, they can stuff votes to inflate or deflate aggregate scores. No public exploit code is identified at time of analysis, but the attack requires only basic HTTP tooling given the exposed nonce.