ReviewX WooCommerce Product Reviews Plugin Improper Authorization Vulnerability Allowing Unauthenticated Data Access and Modification

A vulnerability exists in the ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress, in all versions through 2.2.10. The issue arises from inadequate authorization checks in the userAccessibility() function, enabling unauthenticated attackers to access protected REST API endpoints and manipulate information related to users and the plugin's configuration.

Impact

Exploitation of this vulnerability allows for unauthorized access to sensitive information via the REST API, with the ability to both extract and modify user-related data and plugin settings.

Remediation

Users are advised to update the ReviewX WooCommerce Product Reviews plugin to version 2.2.12 or a newer patched version.