The vulnerability lies in the ReviewX plugin's authorization checks. An unauthenticated attacker can access protected REST API endpoints, allowing extraction and modification of user data and plugin settings. This unauthorized access compromises confidentiality and integrity by exposing private information and enabling configuration changes without permission. The weakness is an improper authorization (CWE‑285).

Vulnerable versions of the ReviewX – Multi‑Criteria Reviews for WooCommerce plugin, distributed under the ReviewX vendor, up to and including 2.2.10, affect any WordPress site running these releases.

The CVSS score of 6.5 indicates moderate severity, and the lack of an EPSS rating or KEV listing reduces immediate visibility of real‑world exploitation. Nonetheless, exploitation is straightforward: an attacker can send crafted REST API requests without authentication to retrieve or alter data. Because no user credentials are required, any person with network access to the WordPress installation can potentially exploit this flaw, making it a significant risk for sites with exposed API endpoints.