Authorization Flaw in A2Reviews WordPress Plugin by A2Z
CVE-2026-116559
Key Information:
Badges
What is CVE-2026-116559?
The A2Reviews WordPress plugin version 1.2.3 contains an authorization bypass vulnerability that allows unauthenticated attackers to modify its settings and product review metadata. This occurs due to improper verification of authorization on multiple API command handlers, which rely on a signature initialized with a default empty value on newly installed instances. Consequently, unauthorized users can gain access to sensitive product metadata and manipulate review data, undermining the integrity and security of the affected WordPress site.
Affected Version(s)
A2Reviews 0 <= 1.2.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.