WordPress Site Reviews plugin <= 8.3.2 - Broken Access Control vulnerability

site-reviews · Missing authorization · CWE-862

Affectedsite-reviews

FixUpdate to 8.3.3 or newer

PublishedOct 1, 12:26 · Patchstack

ScoredOct 1 · 5.3 · Patchstack

Exploit code publicNone known · checked 21:18 UTC

ExploitedNone known · CISA KEV checked 22:11 UTC

What we know

No known exploitation. CISA KEV, checked 22:11 UTC.

No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.

An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.

Description

Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through 8.3.2.

From Patchstack

Affected and fixed versions

ProductAffectedFixed insite-reviewsearlier versions8.3.3

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

patchstack.com/database/wordpress/plugin/site-reviews/vulnerability/wordpress-site-reviews-plugin-8-3-2-broken-access-control-vulnerability?_s_id=cve · patchstack.comvdb entry

Other CVEs in site-reviews

All 7 →

6.5WordPress Site Reviews plugin <= 8.3.5 - Cross Site Scripting (XSS) vulnerability · CVE-2026-118087Oct 29 5.3WordPress Site Reviews plugin <= 8.3.4 - Broken Access Control vulnerability · CVE-2026-110366Oct 16 7.1WordPress Site Reviews plugin <= 8.3.1 - Cross Site Scripting (XSS) vulnerability · CVE-2026-94078Sep 30