The Rate Star Review Vote plugin for WordPress contains a missing authorization flaw in versions up to 1.6.4. The AJAX handler responsible for review voting does not perform capability checks or nonce verification and only verifies that a user is logged in. When the form parameter is set to update, the handler accepts an arbitrary post identifier from the rating_id GET parameter, places it into the update array, and calls wp_update_post(). This operation overwrites the target post’s title, content, author, post type and status. It also updates post metadata via update_post_meta(). The result is a full takeover of any post or page by an authenticated attacker with Subscriber-level access and above.

WordPress sites that have the Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings plugin installed at any version up to and including 1.6.4. The vendor is videowhisper. No specific hardware or operating system requirements are noted, as the vulnerability exists in the WordPress plugin code.

The CVSS score of 4.3 indicates a moderate severity, but exploitation requires only a logged‑in Subscriber or higher role; the vulnerability is not currently listed in CISA KEV and no EPSS score is available. The likely attack vector is an authenticated user making a direct AJAX request with a crafted rating_id parameter, which can be performed from any browser session once the attacker has a legitimate account. An attacker can replace content, change authorship, and alter post types, leading to data integrity and authenticity violations across the site.