CVE-2026-65479

MediumCVSS 5.4

Published: 23/07/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Summary

The Reviewer plugin versions up to 3.14.2 contain a subscriber broken access control vulnerability. An attacker with subscriber privileges can bypass access control mechanisms.

Risk Assessment

A user with subscriber role may gain unauthorized access to functions or data, potentially leading to privilege escalation or information disclosure.

Recommendation

Immediately update the Reviewer plugin to the latest available version.

Other vulnerabilities in Reviewer

CVE-2026-66658High
The Reviewer plugin version 3.14.2 and earlier contains a SQL Injection vulnerability for users with the subscriber role. A user with low privileges can execute malicious SQL queries against the database.

Original NVD description (English source)

Subscriber Broken Access Control in Reviewer <= 3.14.2 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS