The vulnerability is a missing authorization flaw in the Review Manager plugin for WordPress, allowing attackers to exploit incorrectly configured access control security levels. This flaw can enable unauthorized users to perform privileged actions within the review management interface, potentially leading to data tampering and manipulation of review content. The weakness is categorized as CWE‑862, which describes missing privileges checks or access controls.

Review Manager, a plugin created by matthewrubin, is impacted. All released versions up to and including 2.5.0 are vulnerable, as the issue exists from the initial release through the 2.5.0 release. Instances running any of these versions are at risk until an update that addresses the flaw is available.

The CVSS score of 5.3 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at the time of analysis. This vulnerability is not currently listed in CISA’s KEV catalog, implying it has not yet been widely abused. The likely attack vector involves remote exploitation via WordPress URLs that expose review management functions; an attacker with internet access to the site could craft requests to these endpoints without proper authorization, as the control checks are missing.