EUVD-2026-90873
GHSA-m6jp-w9v6-rpvh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Review Schema 3.1.0
-
ExploitSend unauthenticated request to unprotected plugin action
-
ExecutionBypass missing authorization check
-
ImpactModify or disrupt review/schema data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires only that a target site run Review Schema version 3.1.0 with the plugin active; exploitation is remote, network-based, low-complexity, and unauthenticated (PR:N/UI:N) against default configurations, needing no victim interaction. The practical limits on impact are the capped integrity and availability effects (I:L/A:L, C:N) - the attacker can tamper with or disrupt the plugin's review/schema functionality but cannot read confidential data or take over the host. The main uncertainty is the specific unprotected endpoint/action, which the advisory does not name. |
| Impact | This is a moderate, not emergency, issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, 6.5) describes a remotely reachable, low-complexity, unauthenticated (PR:N) broken-access-control flaw with no confidentiality impact and only low integrity and low availability impact - consistent with CWE-862 Missing Authorization where an unauthenticated actor reaches a function that should be restricted. No EPSS score, CISA KEV entry, or public POC was provided, so there is no signal of active or imminent mass exploitation; SSVC-style framing would put exploitation at 'none', automatable as plausible given PR:N/AC:L, and technical impact as partial (not total). The score is moderate rather than high precisely because impact is capped at I:L/A:L with C:N - this is a 'real but low-stakes' authorization gap, not a takeover. The only data source is the Patchstack advisory; NVD enrichment, EPSS, and an explicit fixed version are absent, so prioritize patching on a normal cycle rather than as a crisis. Note the 'Authentication Bypass' tag conflicts with the CWE-862 classification - this is an authorization (access-control) defect, not an authentication bypass. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request directly to a Review Schema plugin endpoint (AJAX/REST action) that fails to enforce a capability or nonce check, invoking a privileged function without logging in. Because PR:N/UI:N, this is scriptable against any site running Review Schema 3.1.0, letting the attacker alter plugin-managed review/schema data (I:L) or disrupt that functionality (A:L). No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Missing authorization checks in the WordPress plugin Review Schema 3.1.0 let unauthenticated, remote attackers invoke plugin functionality that should require elevated privileges, tampering with or disrupting the site's review and structured-data (schema) content. The issue is network-reachable, low-complexity, and requires no victim interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, score 6.5), but impact is bounded: no confidential data exposure (C:N) and only low-level integrity and availability effects (I:L/A:L), so a full site takeover is not possible. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV; independent assessment rates this as a moderate, not emergency, issue with the primary uncertainty being which specific endpoint or action lacks the check, since the Patchstack advisory does not name it.
RemediationAI
No vendor-released patch identified at time of analysis - the supplied data contains no fixed version, vendor advisory, or patch reference for CVE-2026-97280, so treat remediation as risk reduction rather than a version bump. The most reliable action is to deactivate and, if unused, fully remove the Review Schema plugin from any site running 3.1.0; the trade-off is loss of review/schema markup and associated rich-result eligibility in search, which is acceptable unless the plugin is business-critical. If the plugin must stay active, apply virtual patching at the WAF or reverse-proxy layer to block unauthenticated requests targeting the plugin's action handlers - specifically POST requests to /wp-admin/admin-ajax.php carrying the plugin's action parameter, to /wp-admin/admin-post.php, and to any REST namespace registered by Review Schema - which stops the class of exploitation here but risks false positives for other plugins sharing admin-ajax.php and requires ongoing rule maintenance. Additionally, restrict and monitor: rate-limit or challenge unauthenticated POSTs to wp-admin endpoints, audit recent changes to reviews and schema settings for unexpected modifications, and re-check the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/review-schema/vulnerability/wordpress-review-schema-plugin-3-1-0-broken-access-control-vulnerability?_s_id=cve plus the WordPress.org plugin page for a patched release. Once a fixed version ships, upgrade immediately and verify the installed version afterwards; because the underlying defect is a missing capability check, applying a custom capability/nonce guard via a must-use plugin is a viable stopgap for teams with PHP maintenance capability, though it must be re-validated against each plugin update.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-862 (Missing Authorization) in a WordPress plugin, a class of bug where an AJAX action, REST route, or admin-post handler is registered and reachable but never enforces a capability check such as current_user_can() (and often omits nonce verification as well). Because the CVSS vector carries PR:N and UI:N, the unprotected handler is reachable directly over the network by anyone who can send an HTTP request to the target WordPress site - no account, no login, and no user interaction required - and the plugin's own logic then performs an operation the caller was never entitled to perform. Review Schema manages review markup and JSON-LD/structured-data output for WordPress content, so the exposed functionality is most plausibly settings or review/schema data manipulation rather than file or code execution, which is consistent with the assigned C:N/I:L/A:L profile: an attacker can inject, modify, or remove schema/review content and cause limited service disruption, but the vector explicitly excludes confidentiality impact. CPE data (cpe:2.3:a:mamunur_rashid:review_schema:*:*:*:*:*:*:*:*) identifies the Mamunur Rashid "Review Schema" WordPress plugin as the affected product, with 3.1.0 named as the vulnerable version; the wildcard version field means the vulnerability record is not scoped to a single fixed release in the supplied CPE, so other versions should be treated as potentially affected until vendor guidance confirms otherwise. Note that the plugin is also reachable through standard WordPress entry points (admin-ajax.php, admin-post.php, and plugin REST namespaces), which is why the practical attack surface is the whole site rather than a single administrative screen.
Know when Review Schema gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Unauthenticated remote access to a missing-authorization endpoint (PR:N/AV:N/AC:L/UI:N); impact limited to low integrity and low availability with no confidentiality exposure, matching CWE-862 scope.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Missing Authorization vulnerability in Mamunur Rashid Review Schema review-schema allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Review Schema: 3.1.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
More in Review Schema
View allThe RadiusTheme Review Schema WordPress plugin versions up to and including 2.2.6 contains an information disclosure vul
Unauthenticated insecure direct object reference (IDOR) in the RadiusTheme Review Schema WordPress plugin affects all ve
The WordPress Review & Structure Data Schema Plugin - Review Schema plugin for WordPress is vulnerable to unauthorized m
Exploit-DB