Deserialization Vulnerability in Site Reviews Plugin for WordPress
CVE-2026-82925
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 10 September 2026
Badges
What is CVE-2026-82925?
The Site Reviews WordPress plugin prior to version 8.3.0 is vulnerable to a serious deserialization flaw that allows unauthenticated users to inject arbitrary PHP objects. This vulnerability arises from the plugin's failure to properly secure request data during deserialization. It computes a key based on the WordPress nonce, which can be easily derived when the nonce key is absent, left at its default sample value, or is too short. As a result, attackers can potentially control the injected object, depending on the presence of additional security measures within the site's codebase.
Affected Version(s)
Site Reviews 7.2.2 < 8.3.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.