{
 "id": "WPSEC-2026-0793",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0793/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0793/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0793/index.md",
 "title": "Yotpo: Product & Photo Reviews for WooCommerce < 1.8.3 - Improper Certificate Validation in Yotpo API Requests",
 "description": "The Yotpo Product Reviews plugin for WordPress is vulnerable to Improper Certificate Validation in all versions prior to 1.8.3 because TLS certificate verification was disabled for all requests to the Yotpo API. This makes it possible for attackers in a privileged network position between the site and the Yotpo API to intercept or modify that traffic, which carries the store's Yotpo app secret and access tokens as well as customer order data.",
 "plugin": {
  "slug": "yotpo-social-reviews-for-woocommerce",
  "name": "Yotpo: Product & Photo Reviews for WooCommerce",
  "full_name": "Yotpo Product Reviews",
  "wordpress_org": "https://wordpress.org/plugins/yotpo-social-reviews-for-woocommerce/",
  "advisories_url": "https://wpsec.com/vuln/plugin/yotpo-social-reviews-for-woocommerce/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/yotpo-social-reviews-for-woocommerce"
 },
 "type": "UNKNOWN",
 "cwe": [
  "CWE-295"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.8.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.8.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.8.3",
 "remediation": "Update to 1.8.3 or later.",
 "fix_released": "2026-10-08T12:45:29+00:00",
 "published": "2026-10-12T11:49:14+00:00",
 "updated": "2026-10-12T11:06:40.151656+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0793/",
  "https://plugins.svn.wordpress.org/yotpo-social-reviews-for-woocommerce/tags/1.8.3/",
  "https://wordpress.org/plugins/yotpo-social-reviews-for-woocommerce/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/yotpo-social-reviews-for-woocommerce",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-12"
 }
}