Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2025-10736: Unauthorized Access to ReviewX Plugin Data on WordPress
CVE-2025-10736 · published 7 months ago
Summary
The ReviewX plugin for WordPress has a security flaw that allows attackers to access and modify sensitive data, including user information and plugin settings, without needing a password. This could lead to unauthorized changes or theft of sensitive data. Update to the latest version of the plugin to fix the issue.
Original advisory text
The ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to unauthorized access of data due to improper autho...
The ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to unauthorized access of data due to improper authorization checks on the userAccessibility() function in all versions up to, and including, 2.2.10. This makes it possible for unauthenticated attackers to access protected REST API endpoints, extract and modify information related to users and plugin's configuration
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-285Improper Authorization
Timeline
Published23 Mar 2026
Updated3 Nov 2026
First seen23 Mar 2026
Sources
CVE-2025-10736 · NVD
Track software like this
Free during beta