CVE-2026-94274: YayReviews WordPress Information Disclosure

CVE-2026-94274 Overview

CVE-2026-94274 affects the YayReviews WordPress plugin in versions before 1.4.1. The plugin exposes a REST API route that returns individual customer review records without enforcing access controls. Unauthenticated attackers can query this endpoint to harvest reviewer email addresses and non-public review content, including reviews still pending moderation.

The issue falls under Broken Access Control and Information Disclosure. Site operators using YayReviews to collect WooCommerce or storefront feedback are exposed to bulk data scraping until they upgrade to the patched release.

Critical Impact

Unauthenticated remote attackers can enumerate customer review records and exfiltrate reviewer email addresses and pending moderation content from vulnerable sites.

Affected Products

• YayReviews WordPress plugin versions prior to 1.4.1
• WordPress installations that expose the plugin's REST API route to the public internet
• WooCommerce storefronts relying on YayReviews for product review collection

Discovery Timeline

• 2026-09-30 - CVE-2026-94274 published to NVD
• 2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-94274

Vulnerability Analysis

The vulnerability resides in a REST API route registered by the YayReviews plugin. The route returns individual customer review records but does not verify that the caller has permission to read the requested data. Any anonymous HTTP client can invoke the endpoint and receive review objects that include personally identifiable information (PII).

Exposed data includes reviewer email addresses and review content that has not been approved by a moderator. Pending reviews are typically restricted to store administrators, so their disclosure represents a confidentiality breach beyond what public product pages already show.

Because the endpoint accepts identifiers for individual review records, an attacker can iterate through record IDs to enumerate the entire review dataset. This turns a per-record disclosure into a bulk PII harvesting primitive.

Root Cause

The plugin registers a REST route without a permission_callback that restricts access, or the callback returns true unconditionally. WordPress therefore treats the route as public. The route handler then loads the review record and serializes fields intended only for privileged users.

Attack Vector

Exploitation requires only network access to the WordPress site. An attacker issues HTTP requests directly to the plugin's REST endpoint, iterates over review identifiers, and collects the JSON responses. No authentication, user interaction, or elevated privileges are required. See the WPScan Vulnerability Report for technical details on the affected route.

Detection Methods for CVE-2026-94274

Indicators of Compromise

• Repeated unauthenticated GET requests to YayReviews REST API routes under /wp-json/ from a single IP or ASN.
• Sequential enumeration patterns where a client requests review records by incrementing numeric identifiers.
• Unusually large volumes of 2xx responses returning JSON payloads from the plugin's review endpoints.

Detection Strategies

• Inspect web server and WordPress access logs for anonymous traffic hitting plugin-specific REST routes.
• Correlate high-volume review endpoint access with user agents commonly associated with scraping tools.
• Alert on non-browser clients requesting review objects outside of normal storefront navigation flows.

Monitoring Recommendations

• Enable REST API request logging in WordPress and forward logs to a centralized SIEM or data lake for retention.
• Baseline normal review endpoint traffic and alert on deviations in request rate or source diversity.
• Monitor for outbound data exfiltration patterns following spikes in review API traffic.

How to Mitigate CVE-2026-94274

Immediate Actions Required

• Upgrade the YayReviews plugin to version 1.4.1 or later on all WordPress sites.
• Audit web server logs for prior unauthenticated access to the plugin's REST routes and estimate the scope of exposed reviewer data.
• Notify affected customers if evidence of email address harvesting is found, in line with applicable privacy regulations.

Patch Information

The vendor addressed the issue in YayReviews version 1.4.1 by restricting access to the review REST route. Refer to the WPScan Vulnerability Report for the advisory and fix reference.

Workarounds

• Restrict access to /wp-json/ review endpoints at the reverse proxy or web application firewall until the patch is applied.
• Temporarily deactivate the YayReviews plugin on sites that cannot upgrade immediately.
• Require authentication for all plugin REST routes using a WordPress filter that rejects anonymous requests.

# Example nginx rule to block unauthenticated access to the plugin's REST namespace
location ~ ^/wp-json/yayreviews/ {
    deny all;
    return 403;
}