The vulnerability is a missing authorization flaw in the Wiremo Woo Reviews By Wiremo plugin that permits attackers to perform actions normally restricted to authenticated users. This could allow the modification of customer reviews, the injection of malicious content, or other alterations that undermine the integrity and confidentiality of the site’s review system. The weakness is classified as CWE‑862: Lack of Access Control and carries a moderate CVSS score of 5.3, indicating non‑trivial impact if exploited.

The issue affects all installations of the Wiremo Woo Reviews By Wiremo plugin with version 1.4.99 or earlier. No other vendor or product variants are listed.

The EPSS score of less than 1 % indicates a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers could target HTTP endpoints exposed by the plugin to trigger malicious actions without authentication, because the access controls are incorrectly configured. Given the moderate severity and low likelihood, the risk remains moderate but still warrants prompt attention.