The vulnerability in the Grav Star Ratings plugin arises from a missing server‑side authorization check for voting requests. Unauthenticated visitors can exploit the anonymous nonce that the plugin emits via getData() to call the addVote() method directly. Because the vote_access check is performed only on the client side and not re‑verified on the server, attackers can submit votes for ratings that are intended to be disabled or restricted. This results in tampering with rating totals and can undermine the integrity of the rating system, damaging the credibility of the content or service that relies on these ratings.

The issue affects the Grav plugin Star Ratings versions 2.0.1 through 2.0.3, provided by the vendor getgrav under the product grav-plugin-star-ratings. No other version ranges are specified as affected.

The CVSS score of 6.9 indicates a moderate impact, while no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Attackers can access the flaw without any authentication, simply by interacting with the site’s voting interface. The vulnerability is therefore exploitable by any unauthenticated user who can reach the plugin’s API endpoints, making it a low‑barrier attack vector.