Technical impact
The vulnerability is a missing authorization flaw that allows an attacker to bypass normal access controls, giving them the ability to perform actions that should be restricted to privileged users. Because the flaw originates from incorrectly configured security levels in the Site Reviews plugin, an attacker could potentially create, edit, or delete reviews, or otherwise manipulate review data. The weakness is classified as CWE‑862, which highlights the lack of proper access control.
Affected Systems
Gemini Labs Site Reviews is deployed in WordPress sites, and any installation using version 8.3.2 or earlier is affected. The vulnerability applies to all WordPress sites that have the plugin installed and do not upgrade beyond the stated maximum version.
Risk and Exploitability
The CVSS score of 5.3 indicates a moderate risk, and the attack is considered feasible because the vulnerability requires only that the attacker can reach the plugin’s administrative interface or related endpoints. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the plugin’s UI or API, where an authenticated or partially privileged user could exploit the improperly restricted access controls to elevate their privileges or tamper with review content.
