Incorrectly Configured Access Control Security Levels Put Site Reviews at Risk of Missing Authorization Vulnerability

CVE-2023-27625

Summary

The vulnerability in the Paul Ryley Site Reviews plugin arises from a missing authorization check, enabling attackers to exploit incorrectly configured access control security levels. This flaw primarily affects versions from n/a to 6.5.0, potentially allowing unauthorized users to gain access to sensitive functionalities of the Site Reviews plugin. Exploiting this vulnerability could lead to unauthorized data exposure and modifications, thereby jeopardizing the integrity and confidentiality of user-generated content.

References