CVE-2026-82925: Site Reviews WordPress Plugin RCE Vulnerability

CVE-2026-82925 Overview

CVE-2026-82925 affects the Site Reviews WordPress plugin in versions prior to 8.3.0. The plugin deserializes request data and protects that data using a key derived by padding out the site's WordPress nonce key. When the nonce key is missing, left at its sample value, or too short, attackers can compute the key and inject arbitrary PHP objects without authentication. The plugin itself contains no exploitable gadget chain, so downstream impact depends on other code installed on the site.

Critical Impact
Unauthenticated attackers can inject arbitrary PHP objects on WordPress installs where the nonce key is absent, unchanged, or too short, enabling exploitation through any available gadget chain on the site.

Affected Products

Site Reviews WordPress plugin versions prior to 8.3.0
WordPress installations with missing or default NONCE_KEY values
WordPress installations with NONCE_KEY values shorter than the plugin's security threshold

Discovery Timeline

2026-09-10 - CVE-2026-82925 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-82925

Vulnerability Analysis

The Site Reviews plugin accepts serialized data from HTTP requests and passes it to PHP's deserialization routines. To prevent tampering, the plugin protects the serialized payload using a key derived from the site's WordPress NONCE_KEY constant. The derivation logic pads the NONCE_KEY value to reach a required length, meaning short or missing keys collapse into predictable values.

This design fails whenever administrators leave the sample key in wp-config.php, omit NONCE_KEY entirely, or set it to a short string. In these scenarios, an unauthenticated attacker can independently compute the protection key and craft a signed serialized payload. When the plugin deserializes the payload, PHP instantiates attacker-controlled objects. This is a classic insecure deserialization flaw leading to PHP Object Injection.

The Site Reviews codebase does not itself contain a gadget chain that reaches remote code execution. However, WordPress core and other installed plugins or themes frequently expose usable gadgets. Impact therefore ranges from information disclosure to remote code execution depending on site composition.

Root Cause

The root cause is twofold. First, the plugin performs deserialization on untrusted input. Second, the integrity key derivation reduces to a publicly computable value when the underlying secret material is weak. Refer to the WPScan Vulnerability Report for the technical breakdown.

Attack Vector

An unauthenticated remote attacker submits a crafted request to a Site Reviews endpoint on a vulnerable installation. The attacker computes the expected protection key by replicating the plugin's padding logic against a default or empty NONCE_KEY. The plugin validates the payload as authentic and deserializes it, instantiating attacker-chosen PHP classes. Any magic methods triggered on those objects execute in the WordPress request context.

Detection Methods for CVE-2026-82925

Indicators of Compromise

Unexpected POST requests to Site Reviews plugin endpoints containing serialized PHP payloads matching the pattern O: or a: at the start of decoded parameters
Creation or modification of PHP files in wp-content/uploads/ or plugin directories immediately following requests to Site Reviews endpoints
New administrative WordPress users or unexpected changes to the wp_options table
Outbound network connections from the web server process to unknown hosts following plugin traffic

Detection Strategies

Inspect wp-config.php for NONCE_KEY values matching the WordPress sample (put your unique phrase here), empty strings, or values shorter than 64 characters
Scan HTTP access logs for requests to Site Reviews endpoints containing serialized-object markers in query strings or POST bodies
Audit installed Site Reviews plugin version and flag any installation below 8.3.0
Correlate plugin request activity with subsequent PHP process spawns using endpoint telemetry

Monitoring Recommendations

Enable web application firewall rules that identify PHP serialization signatures in HTTP parameters
Monitor file integrity for PHP files inside the WordPress document root and plugin directories
Log and alert on WordPress user creation, role changes, and option table writes
Capture process execution telemetry from the web server user account for anomaly identification

How to Mitigate CVE-2026-82925

Immediate Actions Required

Update the Site Reviews plugin to version 8.3.0 or later on all WordPress installations
Verify wp-config.php contains a NONCE_KEY that is unique, at least 64 characters long, and not the sample value
Regenerate all WordPress salts using the official WordPress secret-key service if the current keys are weak or default
Audit installed plugins and themes for known deserialization gadget chains and remove unnecessary components

Patch Information

The vendor released Site Reviews plugin version 8.3.0, which addresses the deserialization and key-derivation weaknesses. Administrators should apply this update through the WordPress plugin management interface or by downloading the patched release directly. See the WPScan Vulnerability Report for advisory details.

Workarounds

Temporarily deactivate the Site Reviews plugin until the patched version can be installed
Configure a strong, unique NONCE_KEY in wp-config.php to prevent the protection key from becoming publicly computable
Restrict access to plugin endpoints using web server access controls or a web application firewall
Remove or restrict unauthenticated request paths exposed by the plugin at the reverse proxy layer

bash

# Configuration example: generate strong WordPress keys and update wp-config.php
curl -s https://api.wordpress.org/secret-key/1.1/salt/

# Example NONCE_KEY line to place in wp-config.php (replace with generated value)
# define('NONCE_KEY', 'a-long-random-string-at-least-64-characters-in-length');