# Site Reviews <= 8.3.6 - Unauthenticated Protected Field Modification via Review Submission

- **ID:** WPSEC-2026-2202
- **Plugin:** Site Reviews (`site-reviews`), https://wordpress.org/plugins/site-reviews/
- **Affected versions:** all versions before 8.3.7
- **Fixed in:** 8.3.7 (Update to 8.3.7 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-915
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/site-reviews
- **Fix released:** 2026-10-31
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2202/

## Description

The Site Reviews plugin for WordPress is vulnerable to unauthorized modification of protected review fields via the public review submission form in all versions up to, and including, 8.3.6, due to CreateReview::normalize() not resetting the avatar, date, date_gmt and type fields for form submissions. This makes it possible for unauthenticated attackers to submit reviews with an arbitrary avatar image URL or an arbitrary (e.g. backdated) publication date, and to set the review type to any registered review type.

## References

- https://wpsec.com/vuln/WPSEC-2026-2202/
- https://plugins.svn.wordpress.org/site-reviews/tags/8.3.7/
- https://wordpress.org/plugins/site-reviews/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2202/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.