EUVD-2025-208922
GHSA-vw68-5xq3-6845
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
3Description
The ReviewX - WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to unauthorized access of data due to improper authorization checks on the userAccessibility() function in all versions up to, and including, 2.2.10. This makes it possible for unauthenticated attackers to access protected REST API endpoints, extract and modify information related to users and plugin's configuration
Analysis
The ReviewX plugin for WordPress contains an improper authorization vulnerability in the userAccessibility() function that allows unauthenticated attackers to bypass authentication checks and access protected REST API endpoints. Affected versions through 2.2.10 permit unauthorized extraction and modification of user data and plugin configuration, posing a direct threat to WooCommerce installations relying on this review management solution. With a CVSS score of 6.5 and network-based attack vector requiring no user interaction or privileges, this vulnerability presents a moderate-to-significant risk for any WordPress site using the affected plugin.
Technical Context
The vulnerability exists in the REST API authentication middleware layer of the ReviewX plugin (confirmed via source code reference at plugins.trac.wordpress.org/browser/reviewx/2.2.7/app/Rest/Middleware/AuthMiddleware.php). The root cause is classified as CWE-285 (Improper Authorization), where the userAccessibility() function fails to properly enforce authentication before granting access to sensitive endpoints. This allows unauthenticated HTTP requests to interact with APIs that should require valid WordPress user authentication tokens or session validation. The affected product per CPE (cpe:2.3:a:reviewx:reviewx_–_multi-criteria_reviews_for_woocommerce_with_google_reviews_&_schema) is the ReviewX plugin marketed for WooCommerce environments, which integrates review management, Google Reviews aggregation, and schema markup functionality.
Affected Products
The ReviewX plugin for WordPress, distributed via the official WordPress plugin repository, is affected in all versions up to and including 2.2.10. The vulnerability has been confirmed by Wordfence and is tracked under CPE cpe:2.3:a:reviewx:reviewx_–_multi-criteria_reviews_for_woocommerce_with_google_reviews_&_schema. The affected product is primarily used on WooCommerce installations to manage multi-criteria product reviews, aggregate Google Reviews, and generate schema markup. Technical details and vendor advisory information are available via the Wordfence threat intelligence portal at https://www.wordfence.com/threat-intel/vulnerabilities/id/505d7072-8fca-4b86-9b9c-3f39bc4dcfaf?source=cve.
Remediation
WordPress site administrators should immediately upgrade the ReviewX plugin to version 2.2.11 or later once available from the WordPress plugin repository. Until a patched version is released or deployed, implement network-level mitigations by restricting direct access to /wp-json/reviewx/* endpoints via Web Application Firewall (WAF) rules or reverse proxy configuration, allowing requests only from authenticated user agents with valid WordPress session cookies. Additionally, audit recent REST API access logs for suspicious unauthenticated requests to review and configuration endpoints to detect potential exploitation. Review the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/505d7072-8fca-4b86-9b9c-3f39bc4dcfaf?source=cve) for vendor guidance and any released patches. Consider temporarily disabling the plugin on high-value WooCommerce stores until a fix is confirmed.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today