The Gemini Labs Site Reviews WordPress plugin contains a missing authorization defect that allows an attacker who can reach the plugin’s administrative interface or its exposed API to perform actions normally restricted to privileged users. This includes creating, editing, deleting, or viewing reviews and manipulating data that should be protected. The flaw does not grant code execution or full site takeover; it is limited to privilege escalation within the plugin’s scope, potentially compromising the confidentiality, integrity, and availability of review content and related site settings.

Gemini Labs Site Reviews WordPress plugin, versions up to and including 8.3.4.

The CVSS score of 5.3 reflects moderate severity. The EPSS score is less than 1% and the vulnerability is not listed in CISA KEV. The likely attack vector is the plugin’s web interface or exposed API endpoints, which can be accessed over the network. An attacker only needs web access and can exploit the missing authorization by simply requesting those URLs. While full site compromise is not possible, the ability to modify or delete reviews or related data represents a significant risk in environments where the plugin is publicly accessible or where unauthenticated users can reach the affected endpoints.