← CVE index
Vulnerability record/PUBLISHED/Published Nov 15, 2026 06:00:06 UTC

CVE-2026-116559

The A2Reviews WordPress plugin through 1.2.3 does not properly verify authorization on several of its API command handlers, relying on a signature keyed on a value that is empty by default on an unconnected install, allowing unauthenticated attackers to modify A2Reviews WordPress plugin through 1.2.3 settings and product review metadata and to read non-public product metadata.

Base scoreN/A/ 10
SeverityNoneCVSS unscored

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes
Base severityNone
No CVSS vector is available for this record.

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering AuthorityWPScan
Last updatedNov 15, 2026 06:00:06 UTC
PublishedNov 15, 2026 06:00:06 UTC
ReservedOct 26, 2026 14:47:37 UTC

Credits

  • Erwan LR (WPScan)
  • WPScan