The ReviewX — WooCommerce Product Reviews plugin is vulnerable to sensitive information exposure in all versions up to and including 2.2.12 through its syncedData function. This flaw allows unauthenticated users to retrieve personal data such as user names, email addresses, phone numbers, and mailing addresses, exposing confidential customer information and increasing the risk of privacy violations or phishing attacks. The weakness is classified as CWE‑922, reflecting improper handling of sensitive data.

Any WordPress site running the ReviewX plugin version 2.2.12 or earlier is impacted. The vulnerability resides in the plugin’s REST controller that synchronizes review data; therefore, WooCommerce sites that rely on this plugin for product reviews must review their plugin version and configuration. Versions newer than 2.2.12 are assumed to have addressed the flaw, although the exact revision is not specified.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available, and the vulnerability is not cataloged in CISA’s KEV list, suggesting no large‑scale exploitation reports yet. The attack vector is inferred to be public and unauthenticated: an attacker only needs to access the syncedData endpoint from outside the site. No credentials or further privileges are required, making exploitation straightforward for anyone with internet access.