Description
The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer review records, including reviews still pending moderation, allowing unauthenticated attackers to harvest reviewers' email addresses and other non-public review content.
Published: 2026-09-30
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Sensitive Data Disclosure
Action: Patch/Update
AI Analysis

Impact

The vulnerability is an instance of CWE-200 Information Exposure. An unauthenticated WordPress plugin route exposes a REST API endpoint that returns individual customer review records, including those pending moderation. The data includes email addresses and other review content that are not meant for public consumption. An attacker can harvest this sensitive information, compromising user privacy and possibly enabling further targeting.

Affected Systems

WordPress sites using the YayReviews plugin version 1.0.4 through 1.4.0 are affected. The vulnerability exists in all builds prior to 1.4.1.

Risk and Exploitability

The EPSS score is less than 1% (approximately 0.00145), indicating an extremely low but non-zero exploit probability. KEV is not listed. The exposure is immediate and does not require elevated privileges; any internet-connected WordPress installation running the affected plugin can be queried by anyone. The CVSS score of 5.3 reflects moderate severity. The lack of authentication allows unrestricted access to sensitive data, posing a substantial risk for all users who receive or post reviews.

Generated by OpenCVE AI on September 30, 2026 at 23:28 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update YayReviews to version 1.4.1 or later so the API route is properly locked down.
  • If an update cannot be applied immediately, add an authentication requirement to the vulnerable REST API route or block the endpoint entirely with a firewall or WordPress security plugin.
  • Implement additional application or network-level hardening—such as disabling unused REST API endpoints or whitelisting only trusted hosts—to reduce potential attack surface.

Generated by OpenCVE AI on September 30, 2026 at 23:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 21:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Wed, 30 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 30 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
CWE-284

Wed, 30 Sep 2026 06:15:00 +0000

Type Values Removed Values Added
Description The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer review records, including reviews still pending moderation, allowing unauthenticated attackers to harvest reviewers' email addresses and other non-public review content.
Title YayReviews 1.0.4 - 1.4.0 - Unauthenticated Sensitive Data Disclosure via REST API
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-09-30T13:37:21.390Z

Reserved: 2026-09-21T09:21:44.365Z

Link: CVE-2026-94274

cve-icon Vulnrichment

Updated: 2026-09-30T13:20:47.381Z

cve-icon NVD

Status : Deferred

Published: 2026-09-30T06:17:10.367

Modified: 2026-09-30T16:28:31.510

Link: CVE-2026-94274

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T23:30:07Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor