Site Reviews EUVD-2026-90794

Requires the Site Reviews plugin (version n/a through 8.3.2) installed and active on a WordPress site, with the vulnerable access-control-gated action reachable by network requests. Per the CVSS vector (PR:N/UI:N/AC:L), no authentication, no user interaction, and no elevated privileges are needed, and default configurations are exploitable since the access-control levels are incorrectly configured by the plugin itself. Impact is LIMITED to integrity (I:L) - no confidentiality or availability consequence - which is the primary factor capping real-world severity.

All signals point to a low-to-moderate, real-but-not-urgent issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) describes a network-reachable, low-complexity, unauthenticated flaw with no user interaction, but with impact limited to integrity-only (I:L) and no confidentiality or availability effect - consistent with CWE-862 Missing Authorization allowing an unprivileged actor to perform a state-changing action gated by an incorrectly configured access-control level. No EPSS score, no CISA KEV listing, and no public POC are provided, so there is no evidence of active or imminent exploitation; the single reference is the Patchstack database entry. This is a 'moderate CVSS, low real-world urgency' case: unauthenticated reachability raises baseline exposure, but the capped integrity-only impact and absence of exploitation signals keep it well below critical priority. Note the 'Authentication Bypass' tag conflicts with the CWE-862/authorization nature of the flaw - this is broken access control by an unauthenticated requester, not a credential/authentication bypass.

An unauthenticated attacker sends a crafted HTTP request to a Site Reviews plugin endpoint that fails to verify the caller's authorization level, performing a review-related action (e.g., submitting, modifying, or manipulating review state) that should require proper privileges. Because no authentication, user interaction, or special complexity is required, the request succeeds against a vulnerable default-reachable endpoint, yielding a limited integrity impact. No public exploit code has been identified at time of analysis.