CVE-2026-57318 Overview
CVE-2026-57318 is a sensitive data exposure vulnerability affecting the WordPress Site Reviews plugin in versions up to and including 8.0.11. The flaw allows authenticated users with Subscriber-level privileges to access sensitive information that should be restricted to higher-privileged roles. The vulnerability is classified under [CWE-201: Insertion of Sensitive Information Into Sent Data]. Exploitation requires only low-privileged authentication and no user interaction, making the flaw reachable by any registered user of an affected WordPress site.
Critical Impact
Authenticated Subscriber-level attackers can retrieve sensitive review data from vulnerable Site Reviews plugin installations without administrative privileges.
Affected Products
- WordPress Site Reviews plugin versions <= 8.0.11
- WordPress installations with the Site Reviews plugin enabled
- Sites permitting Subscriber-level account registration with the plugin active
Discovery Timeline
- 2026-06-26 - CVE-2026-57318 published to NVD
- 2026-06-26 - Last updated in NVD database
Technical Details for CVE-2026-57318
Vulnerability Analysis
The Site Reviews plugin fails to enforce sufficient authorization checks before returning review-related data to authenticated requests. As a result, users holding the WordPress Subscriber role, the lowest privileged authenticated role, can access sensitive information intended for administrators or reviewers. The exposure falls under [CWE-201], where sensitive data is inserted into responses sent to unauthorized recipients. The flaw is network-reachable and requires no user interaction, though attackers must first hold a valid Subscriber account on the target site.
Root Cause
The root cause is missing or insufficient capability checks on plugin endpoints or data-returning functions. The plugin returns data fields containing sensitive review metadata to requests where the caller lacks the intended moderate_comments or equivalent administrative capability. Refer to the Patchstack Vulnerability Report for the specific affected functions and payload details.
Attack Vector
An attacker registers or obtains a Subscriber account on a WordPress site running the vulnerable plugin. The attacker then issues authenticated requests to the affected plugin endpoints. The server returns sensitive review data without validating that the requester holds an administrative capability. No code execution or write access is granted; the impact is confined to confidentiality of review data. Exploitation is straightforward over standard HTTP or HTTPS requests to the WordPress REST API or admin-ajax.php handler exposed by the plugin.
Detection Methods for CVE-2026-57318
Indicators of Compromise
- Unexpected requests from Subscriber accounts to Site Reviews plugin REST endpoints or admin-ajax.php actions
- Bursts of authenticated requests from newly registered low-privileged accounts
- Access log entries showing Subscriber sessions retrieving review metadata not visible in the public UI
Detection Strategies
- Audit WordPress access logs for requests to /wp-json/site-reviews/* or plugin-specific AJAX actions originating from Subscriber-role users.
- Enable WordPress audit logging plugins to record REST API calls and capability checks per user role.
- Correlate new user registrations with subsequent authenticated plugin API activity within short time windows.
Monitoring Recommendations
- Monitor for spikes in wp-login.php registrations followed by authenticated plugin endpoint access.
- Alert on repeated 200 OK responses to plugin endpoints from accounts holding only the Subscriber capability set.
- Track outbound data volume from WordPress hosts to identify bulk enumeration of review records.
How to Mitigate CVE-2026-57318
Immediate Actions Required
- Update the Site Reviews plugin to a version later than 8.0.11 as soon as a patched release is available from the vendor.
- Disable open user registration if not required for site functionality to reduce the pool of potential attackers.
- Review existing Subscriber accounts and remove any created from suspicious sources.
Patch Information
Consult the Patchstack Vulnerability Report for the fixed version and vendor-supplied patch guidance. Apply the update through the WordPress admin plugin update interface or via WP-CLI.
Workarounds
- Deactivate the Site Reviews plugin until a patched version is installed if review functionality is not business-critical.
- Restrict access to WordPress REST API and admin-ajax.php endpoints for Subscriber-role accounts via a web application firewall rule.
- Temporarily set users_can_register to false in WordPress general settings to prevent new low-privileged account creation.
# Configuration example
wp plugin deactivate site-reviews
wp option update users_can_register 0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
