EUVD-2026-89925
GHSA-7869-8wr7-r83c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Review Schema <=3.1.0
-
DeliverySend request with manipulated object identifier
-
ExploitBypass ownership/authorization check (IDOR)
-
ExecutionModify unauthorized record
-
ImpactLow integrity impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires a target site running the Review Schema WordPress plugin at version 3.1.0 or earlier; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication and no user interaction are needed, and default configurations appear exploitable. The main limiting factor is impact scope, not access: the flaw only permits Low integrity modification (C:N/A:N), so the realistic damage is bounded to unauthorized changes to the objects the IDOR exposes. The exact vulnerable endpoint/parameter is not documented in the available data, which limits precise defensive targeting beyond upgrading the plugin. |
| Impact | This is a moderate-severity, low-real-risk issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) describes a remotely reachable, unauthenticated, low-complexity flaw with NO user interaction - but the impact is confined to integrity-only, and only Low (I:L). There is no confidentiality (C:N) or availability (A:N) impact, which caps the practical severity. No EPSS score, no CISA KEV listing, and no public POC were supplied, so exploitation is 'no public exploit identified at time of analysis.' The description is sparse: it names the IDOR class (CWE-639) and the affected ceiling (<= 3.1.0) but does not identify the vulnerable endpoint, parameter, or the specific object being manipulated, so the concrete integrity effect cannot be independently verified. Note also a minor signal tension: the reference URL text says 'Insecure Direct Object References' consistent with CWE-639, while the input Tags label this 'Authentication Bypass' - IDOR is an authorization (access-control) weakness, not authentication bypass, so the tag is loosely applied. Overall this is a real-but-low-priority patch-when-convenient issue rather than an emergency, given the integrity-only Low impact and absence of any active-exploitation or POC signals. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a crafted request to a Review Schema plugin endpoint, substituting or incrementing an object identifier to reference records belonging to other users or contexts, and thereby modifies data they should not control (I:L). No POC or exploit code was provided, and the exact endpoint/parameter is not documented in the available data, so the precise object and mutation remain unconfirmed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Unauthenticated insecure direct object reference (IDOR) in the RadiusTheme Review Schema WordPress plugin affects all versions up to and including 3.1.0, allowing remote attackers to reach plugin objects by manipulating an identifier without any login or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is network-reachable and unauthenticated, but the scope is narrow: only low-integrity modification (C:N/I:L/A:N), so the practical outcome is unauthorized alteration of the objects the IDOR exposes rather than data disclosure or site takeover. No confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and no fixed version is specified in the available intelligence. Overall this is a moderate-severity, low-real-risk issue whose main uncertainty is the undocumented endpoint and parameter.
RemediationAI
No patched version is identified in the available intelligence, so the first step is to check the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/review-schema/vulnerability/wordpress-review-schema-plugin-3-1-0-insecure-direct-object-references-idor-vulnerability?_s_id=cve) and the RadiusTheme vendor channel for a release newer than 3.1.0 and update the plugin as soon as one is published; per the vendor advisory being the authoritative source, do not assume any specific version number beyond 3.1.0 is the fix. If no update is available yet, deactivate and remove the plugin - this fully closes the exposure but costs the review/rating rich-snippet markup the plugin generates, which may affect search result presentation. As a transitional compensating control, use a WAF or reverse proxy to reject unauthenticated POST/PUT requests to the plugin's REST routes and admin-ajax.php actions (the exact endpoint and parameter are not documented in the available data, so profiling normal traffic first is required and overly broad rules risk breaking legitimate front-end review submission). Because the impact is integrity-only, also monitor for unexplained changes to review entries and stored schema data, and restrict writer-level WordPress accounts as a secondary precaution. No vendor-released patch was identified at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), the classic IDOR pattern in which an application trusts a client-supplied object identifier - such as a review, schema, or template record ID - and performs the requested action without verifying that the caller is permitted to act on that object. In the WordPress plugin context this typically manifests as a REST API route lacking a proper permission_callback, or an admin-ajax.php action lacking both a nonce check and a capability check, letting a request supply an arbitrary numeric key. The CPE string cpe:2.3:a:radiustheme:review_schema:*:*:*:*:*:*:*:* uses a wildcard version, meaning the affected surface covers the whole plugin line through 3.1.0 rather than a single build; the vendor namespace is RadiusTheme. The plugin's purpose is to emit structured review/rating markup (schema.org review data) for SEO rich results, so the objects at risk are stored review and schema records within the WordPress database - consistent with the integrity-only impact in the CVSS vector and the Patchstack 'Authentication Bypass' tagging.
Know when Review Schema gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Unauthenticated (PR:N) network IDOR with no user interaction; integrity-only Low impact per description, with no confidentiality or availability effect (C:N/A:N).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Insecure Direct Object References (IDOR) in Review Schema <= 3.1.0 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Review Schema
View allThe RadiusTheme Review Schema WordPress plugin versions up to and including 2.2.6 contains an information disclosure vul
Missing authorization checks in the WordPress plugin Review Schema 3.1.0 let unauthenticated, remote attackers invoke pl
The WordPress Review & Structure Data Schema Plugin - Review Schema plugin for WordPress is vulnerable to unauthorized m
Exploit-DB