The BizReview WordPress plugin contains a missing authorization flaw that lets an attacker bypass required access controls. This broken access control can be used to view, add, edit, or delete review content and potentially manipulate other plugin data without proper user permissions, effectively compromising confidentiality and integrity of site content.

The vulnerability affects all installations of the Foysal Imran BizReview plugin from the initial release through version 1.5.13. Any WordPress site that has installed these versions is potentially exposed, regardless of the WordPress core version. The plugin’s publicly accessible endpoints are the likely points of exploitation.

The flaw is a classic broken access control scenario (CWE‑862). While CVSS and EPSS metrics are not available, the impact is high because an attacker can gain privileged operations without authentication. The attack vector is inferred to be remote, via HTTP requests to plugin endpoints that should otherwise be secured. No official KEV listing is present, but the absence of a patch means the risk remains significant for all affected sites.