CVE-2025-10731

Published: Mar 23, 2026 Last Modified: Mar 23, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 5,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: low
Integrity: none
Availability: none

Description

AI Translation Available

The ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.12 via the allReminderSettings function. This makes it possible for unauthenticated attackers to obtain authentication tokens and subsequently bypass admin restrictions to access and export sensitive data including order details, names, emails, addresses, phone numbers, and user information.

285

Improper Authorization

Draft
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Integrity Access Control
Potential Impacts:
Read Application Data Read Files Or Directories Modify Application Data Modify Files Or Directories Gain Privileges Or Assume Identity Execute Unauthorized Code Or Commands
Applicable Platforms
Technologies: Database Server, Not Technology-Specific, Web Server
Likelihood of Exploit: High
View CWE Details
https://plugins.trac.wordpress.org/browser/reviewx/tags/2.2…
https://plugins.trac.wordpress.org/browser/reviewx/tags/2.2.7/app/Rest/Controll…
https://plugins.trac.wordpress.org/browser/reviewx/tags/2.2…
https://plugins.trac.wordpress.org/browser/reviewx/tags/2.2.7/app/Rest/Controll…
https://plugins.trac.wordpress.org/browser/reviewx/tags/2.2…
https://plugins.trac.wordpress.org/browser/reviewx/tags/2.2.7/app/Rest/Middlewa…
https://www.wordfence.com/threat-intel/vulnerabilities/id/0…
https://www.wordfence.com/threat-intel/vulnerabilities/id/06b290c2-e458-46da-ab…