What is the CVSS score of CVE-2026-57318?

CVE-2026-57318 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Site Reviews CVE-2026-57318

EUVD-2026-39731 MEDIUM

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-06-26 audit@patchstack.com

GHSA-6gq8-6wjm-24r8

WordPress Information Disclosure Wordpress Plugin

6.5

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible at low complexity; subscriber-level authentication required (PR:L); high confidentiality impact from PII exposure; no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:18 vuln.today

DescriptionCVE.org

Subscriber Sensitive Data Exposure in Site Reviews <= 8.0.11 versions.

AnalysisAI

Sensitive data exposure in the Site Reviews WordPress plugin (versions through 8.0.11) allows authenticated users holding at minimum a subscriber-level account to access private or sensitive review-related data they should not be permitted to view, resulting in high confidentiality impact. The CVSS vector (PR:L, AV:N, AC:L) confirms the flaw is network-exploitable at low complexity with no user interaction required beyond possessing a basic WordPress account. No public exploit code or active exploitation has been identified at time of analysis, though the low barrier to exploitation (any registered user) elevates practical risk.

Technical ContextAI

Site Reviews is a WordPress plugin that enables sites to collect, manage, and display user-submitted reviews, handling potentially sensitive user data such as email addresses, IP addresses, and review metadata. CWE-201 (Insertion of Sensitive Information Into Sent Data) indicates the root cause is the plugin improperly including private or restricted data fields in API responses or rendered output accessible to lower-privileged users - specifically subscribers. In WordPress's role hierarchy, subscriber is the lowest authenticated role, intended only to read content. The flaw suggests the plugin fails to enforce adequate access controls on data retrieval endpoints or REST API responses, returning fields scoped to administrators or site owners to any authenticated requester.

RemediationAI

The primary remediation is to update the Site Reviews WordPress plugin to a version beyond 8.0.11; however, the exact patched release version is not independently confirmed from available data - the fix version is not specified in NVD CPE or EUVD records. Site administrators should consult the official Patchstack advisory at https://patchstack.com/database/wordpress/plugin/site-reviews/vulnerability/wordpress-site-reviews-plugin-8-0-11-sensitive-data-exposure-vulnerability and the WordPress plugin repository for the latest available release. As an interim compensating control, restricting new user registrations on the WordPress site will reduce the pool of potential attackers, though this may impact legitimate site functionality. Additionally, administrators can audit which data fields the plugin exposes through its REST API endpoints and, if technically feasible, block direct access to those endpoints via web application firewall rules for non-admin roles while awaiting a confirmed patched version.