Site Reviews CVE-2026-110366

Exploitation requires a target WordPress site running the Gemini Labs Site Reviews plugin at version 8.3.4 or earlier with an affected endpoint reachable over the network. Per the description, the flaw stems from incorrectly configured access control security levels (a missing authorization check), so exploitation does not require authentication (PR:N) or user interaction (UI:N) against a default install. The principal limiting factor is impact scope, not access: the CVSS vector shows integrity-only, LOW impact with no confidentiality or availability effect, meaning an attacker can tamper with a limited set of plugin-controlled data rather than read sensitive data or take over the site. Realistic risk is therefore constrained to sites that both run the vulnerable version and expose the affected functionality publicly.

This is a medium-severity (CVSS 5.3) broken access control / missing authorization flaw (CWE-862) in the Site Reviews WordPress plugin. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) indicates a network-reachable, low-complexity issue requiring no privileges or user interaction, but with impact limited to integrity-only, and only at a LOW level - there is no confidentiality or availability impact. The low integrity-only impact is the dominant reason this scores medium rather than high: an unauthenticated actor can likely invoke a protected function or modify a limited subset of data (e.g., review-related records), not achieve full compromise. No EPSS score was supplied in the input, so exploitation probability cannot be quantified. The vulnerability is NOT listed in CISA KEV and no public exploit (POC) is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The reporting tag 'Authentication Bypass' overstates the issue; both the CWE-862 classification and the Patchstack reference title ('broken-access-control-vulnerability') describe missing authorization on an already-reachable endpoint rather than a true authentication bypass - this distinction should be verified against the vendor advisory. Overall this is a real but modest-priority issue: patch in routine cycles rather than emergency response, prioritizing internet-exposed WordPress sites running Site Reviews ≤ 8.3.4.

An unauthenticated attacker sends a crafted HTTP request directly to a Site Reviews plugin endpoint that fails to enforce an authorization/capability check, allowing them to invoke a restricted action and tamper with a limited set of plugin-managed data (consistent with the integrity-only, low impact in the CVSS vector). Because PR:N and UI:N apply, no login or victim interaction is needed, but the low complexity and lack of confidentiality/availability impact mean the practical payoff is limited to data modification rather than site takeover. No public exploit code is referenced, so exploitation would require the attacker to independently identify the affected endpoint.