CVEsGemini LabsCVE-2026-110366Published Oct 16, 06:54 · Updated Oct 16, 15:09 UTC
5.3
MediumCVSS 3.1 · from Patchstack
CVE-2026-110366

WordPress Site Reviews plugin <= 8.3.4 - Broken Access Control vulnerability

site-reviews · Missing authorization · CWE-862
Affectedsite-reviews
FixUpdate to 8.3.5 or newer
PublishedOct 16, 06:54 · Patchstack
ScoredOct 16 · 5.3 · Patchstack
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:11 UTC

What we know

No known exploitation. CISA KEV, checked 22:11 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.

Description

Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through 8.3.4.

From Patchstack

Affected and fixed versions

ProductAffectedFixed insite-reviewsearlier versions8.3.5

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

patchstack.com/database/wordpress/plugin/site-reviews/vulnerability/wordpress-site-reviews-plugin-8-3-4-broken-access-control-vulnerability?_s_id=cve · patchstack.comvdb entry

Other CVEs in site-reviews

All 7 →
6.5WordPress Site Reviews plugin <= 8.3.5 - Cross Site Scripting (XSS) vulnerability · CVE-2026-118087Oct 295.3WordPress Site Reviews plugin <= 8.3.2 - Broken Access Control vulnerability · CVE-2026-103340Oct 17.1WordPress Site Reviews plugin <= 8.3.1 - Cross Site Scripting (XSS) vulnerability · CVE-2026-94078Sep 30