The Site Reviews WordPress plugin, in all releases prior to 8.3.0, accepts request data that is later deserialized without proper validation. The plugin derives the key used to protect that data from the site’s WordPress nonce key. When the nonce key is missing, left at its sample value, or too short, the derived key becomes publicly computable. This flaw allows unauthenticated users to inject arbitrary PHP objects via the form signature parameter; the plugin itself does not provide an immediate code‑execution path, so the eventual impact depends on other active code on the site.

WordPress sites that have installed the Site Reviews plugin at any version before 8.3.0, including the range 7.2.2 through 8.2.2. The vulnerability exists irrespective of the specific WordPress core version, as it hinges solely on plugin behavior and the state of the nonce key.

An attacker can trigger the vulnerable endpoint remotely via a crafted HTTP request; no authentication is required. The EPSS score of < 1% and the CVSS score of 8.1 indicate a low probability of exploitation but a high severity if exploited. The vulnerability is not listed in CISA KEV, suggesting it has not yet been actively exploited, but the potential for code execution makes it high risk should the site host other code that can be invoked from the injected objects.