Grav Plugin Star Ratings
Monthly
Grav Star Ratings plugin versions 2.0.1 through 2.0.3 allow unauthenticated visitors to submit votes on restricted or disabled ratings because the vote_access and readonly restrictions are enforced only in client-side code. Attackers can obtain the anonymous nonce that getData() already emits publicly and call addVote() directly, manipulating rating aggregates; the confirmed impact is limited to data integrity with no confidentiality or availability loss. No public exploit code or active exploitation is identified at time of analysis.
Grav Star Ratings plugin versions 2.0.1 through 2.0.3 allow unauthenticated visitors to submit votes on restricted or disabled ratings because the vote_access and readonly restrictions are enforced only in client-side code. Attackers can obtain the anonymous nonce that getData() already emits publicly and call addVote() directly, manipulating rating aggregates; the confirmed impact is limited to data integrity with no confidentiality or availability loss. No public exploit code or active exploitation is identified at time of analysis.