CVE-2026-97280

MediumCVSS 6.5

Published: 01/10/2026(UTC)Updated: 01/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

Missing Authorization vulnerability in Review Schema version 3.1.0 allows exploitation of incorrectly configured access control security levels.

Risk Assessment

Unauthorized users may access administrative functions, potentially leading to data modification or plugin takeover.

Recommendation

Update Review Schema to a patched version and review access control configuration.

Other vulnerabilities in Review Schema

CVE-2026-97282Medium
The Review Schema plugin in versions up to and including 3.1.0 contains an Insecure Direct Object References (IDOR) vulnerability accessible without authentication. An unauthenticated attacker can access objects they should not have access to.

Original NVD description (English source)

Missing Authorization vulnerability in Mamunur Rashid Review Schema review-schema allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Review Schema: 3.1.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS