The vulnerability is an unauthenticated broken authentication flaw in the ReviewX plugin versions 2.3.6 and earlier. Classified as CWE-288, it allows an attacker to bypass the plugin’s login process and access protected functions without valid credentials. The CVE description indicates that authentication can be broken, and it is inferred that this could enable unauthorized use of the plugin’s administrative features.

WordPress installations that have the ReviewX plugin at or below version 2.3.6 are affected. The CNA lists the product as ReviewX:ReviewX, and the version information confirms that all releases up to 2.3.6 are vulnerable. Sites using those plugin releases could be compromised if an attacker can reach the plugin’s login endpoint.

The CVSS score of 7.5 signals a high severity, while the EPSS score of < 1 % indicates a low likelihood of exploitation at the time of analysis. The vulnerability is not included in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is remote and does not require authentication; an attacker could send crafted HTTP requests to the plugin’s resources to exploit the broken login flow, potentially gaining unauthorized access to plugin functionality.