Vulnerabilities / Site Reviews / WPSEC-2026-2202
Site Reviews <= 8.3.6 - Unauthenticated Protected Field Modification via Review Submission
Medium 5.3
CWE-915Fixed in 8.3.7
- ID
- WPSEC-2026-2202
- Plugin
- Site Reviews (site-reviews)
- Affected
- all versions before 8.3.7
- Remediation
- Update to 8.3.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-915
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- Site Reviews on WPSec AttackSurface
- Fix released
- Published
Description
The Site Reviews plugin for WordPress is vulnerable to unauthorized modification of protected review fields via the public review submission form in all versions up to, and including, 8.3.6, due to CreateReview::normalize() not resetting the avatar, date, date_gmt and type fields for form submissions. This makes it possible for unauthenticated attackers to submit reviews with an arbitrary avatar image URL or an arbitrary (e.g. backdated) publication date, and to set the review type to any registered review type.
References
- https://wpsec.com/vuln/WPSEC-2026-2202/
- https://plugins.svn.wordpress.org/site-reviews/tags/8.3.7/
- https://wordpress.org/plugins/site-reviews/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS