CVE-2026-110366

MediumCVSS 5.3

Published: 16/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 16/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

The Site Reviews plugin (versions up to and including 8.3.4) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control levels. This may enable unauthorized users to perform actions reserved for higher privileges.

Risk Assessment

An unauthorized user may perform actions they should not have access to, potentially leading to data modification or disclosure.

Recommendation

Update the Site Reviews plugin to a version newer than 8.3.4 and verify permission configuration.

Other vulnerabilities in Site Reviews WordPress plugin

CVE-2026-82925High
The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or too short to be secret. This allows unauthenticated users to inject arbitrary PHP objects on such installs. The plugin's own code contains no chain onward from the injected object, so how far it reaches depends on the other code present on the site.

Original NVD description (English source)

Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through 8.3.4.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS