{
 "id": "WPSEC-2026-2202",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2202/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2202/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2202/index.md",
 "title": "Site Reviews <= 8.3.6 - Unauthenticated Protected Field Modification via Review Submission",
 "description": "The Site Reviews plugin for WordPress is vulnerable to unauthorized modification of protected review fields via the public review submission form in all versions up to, and including, 8.3.6, due to CreateReview::normalize() not resetting the avatar, date, date_gmt and type fields for form submissions. This makes it possible for unauthenticated attackers to submit reviews with an arbitrary avatar image URL or an arbitrary (e.g. backdated) publication date, and to set the review type to any registered review type.",
 "plugin": {
  "slug": "site-reviews",
  "name": "Site Reviews",
  "full_name": "Site Reviews",
  "wordpress_org": "https://wordpress.org/plugins/site-reviews/",
  "advisories_url": "https://wpsec.com/vuln/plugin/site-reviews/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/site-reviews"
 },
 "type": "OBJECT INJECTION",
 "cwe": [
  "CWE-915"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "8.3.7",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 8.3.7"
  ]
 },
 "introduced_in": null,
 "fixed_in": "8.3.7",
 "remediation": "Update to 8.3.7 or later.",
 "fix_released": "2026-10-31T19:10:49+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:19:45.074919+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2202/",
  "https://plugins.svn.wordpress.org/site-reviews/tags/8.3.7/",
  "https://wordpress.org/plugins/site-reviews/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/site-reviews",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-03"
 }
}