{
 "id": "WPSEC-2026-0751",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0751/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0751/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0751/index.md",
 "title": "BuddyPress Member Reviews <= 3.8.0 - Authenticated (Subscriber+) Missing Authorization to Moderation Bypass via Review Update",
 "description": "The BuddyPress Member Reviews plugin for WordPress is vulnerable to a moderation bypass in all versions up to, and including, 3.8.0 due to the review update handler forcing the review's status to 'publish' on every edit and the Update Review setting only being enforced by hiding the Edit button. This makes it possible for authenticated attackers who wrote a review to edit a pending or report-hidden review and have it published immediately without moderator approval.",
 "plugin": {
  "slug": "bp-user-profile-reviews",
  "name": "BuddyPress Member Reviews",
  "full_name": "Wbcom Designs – BuddyPress Member Reviews",
  "wordpress_org": "https://wordpress.org/plugins/bp-user-profile-reviews/",
  "advisories_url": "https://wpsec.com/vuln/plugin/bp-user-profile-reviews/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/bp-user-profile-reviews"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.8.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.8.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.8.1",
 "remediation": "Update to 3.8.1 or later.",
 "fix_released": "2026-10-09T10:52:53+00:00",
 "published": "2026-10-10T15:41:27+00:00",
 "updated": "2026-10-10T14:54:05.077689+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0751/",
  "https://plugins.svn.wordpress.org/bp-user-profile-reviews/tags/3.8.1/",
  "https://wordpress.org/plugins/bp-user-profile-reviews/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/bp-user-profile-reviews",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-10"
 }
}