JetReviews CVE-2026-61975

No special conditions beyond the plugin being installed and active - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against any WordPress installation running JetReviews version 3.0.1 or earlier with the plugin active. Limiting factors: the site must have the JetReviews plugin installed, enabled, and network-accessible; exploitation is bounded to read-only information disclosure with no write or availability impact. The specific endpoint or trigger mechanism (e.g., which REST route or shortcode) is not detailed in the available description - consult the Patchstack advisory for technical specifics. Sites that have deactivated the plugin or blocked REST API access at the perimeter are not exposed.

The CVSS 3.1 base score of 5.3 reflects a medium-severity finding with AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - network-reachable, trivially exploitable without credentials, but limited to partial confidentiality impact with no integrity or availability consequence. The unchanged scope and low confidentiality impact cap the score. However, the real-world risk depends heavily on what data is exposed: if API keys or admin credentials are leaked, the downstream impact could far exceed the CVSS score suggests. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. No KEV listing exists and no POC has been confirmed, indicating no public exploitation campaign at time of analysis. The low attack complexity and zero authentication requirement mean opportunistic scanning is realistic once the endpoint is known. This is a genuine priority for WordPress operators running this plugin version, but not an emergency for organizations without it installed.

An unauthenticated attacker discovers a WordPress site running JetReviews ≤ 3.0.1, then sends a crafted HTTP request to the plugin's exposed endpoint - likely a REST API route or AJAX handler - that returns sensitive embedded data such as an API key or credential. No public exploit code has been identified at time of analysis, but the low complexity vector suggests the technique is straightforward once the vulnerable endpoint path is identified, potentially through passive enumeration of WordPress plugin fingerprints.