Reviewer
Monthly
SQL injection in the Reviewer WordPress plugin (versions ≤ 3.14.2) by mvpthemes allows any authenticated subscriber-level user to query the underlying WordPress database over the network without user interaction. The changed scope (S:C) in the CVSS vector indicates that successful exploitation can reach data beyond the plugin's own tables, yielding high confidentiality impact against potentially the full WordPress database. Reported by Patchstack; no public exploit or CISA KEV listing is identified at time of analysis.
Broken access control in the Reviewer WordPress plugin (versions ≤ 3.14.2) allows subscriber-level authenticated users to perform actions beyond their intended authorization scope, resulting in limited integrity and availability impact on affected installations. Reported by Patchstack and tracked under EUVD-2026-48090, the flaw stems from missing authorization checks (CWE-862) on one or more plugin endpoints. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
SQL injection in the Reviewer WordPress plugin (versions ≤ 3.14.2) by mvpthemes allows any authenticated subscriber-level user to query the underlying WordPress database over the network without user interaction. The changed scope (S:C) in the CVSS vector indicates that successful exploitation can reach data beyond the plugin's own tables, yielding high confidentiality impact against potentially the full WordPress database. Reported by Patchstack; no public exploit or CISA KEV listing is identified at time of analysis.
Broken access control in the Reviewer WordPress plugin (versions ≤ 3.14.2) allows subscriber-level authenticated users to perform actions beyond their intended authorization scope, resulting in limited integrity and availability impact on affected installations. Reported by Patchstack and tracked under EUVD-2026-48090, the flaw stems from missing authorization checks (CWE-862) on one or more plugin endpoints. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.