The vulnerability is a missing authorization flaw that allows an attacker with sufficient privileges to gain unauthorized access to the WordPress Review Schema plugin’s configuration and data. Because the plugin exposes review data management functions, an attacker could read, modify, or delete review content, potentially compromising the authenticity of user feedback. The flaw directly maps to CWE-862, which characterizes broken access control as an inability to restrict access appropriately.

This issue affects the WordPress Review Schema plugin, version 3.1.0, developed by Mamunur Rashid. All WordPress installations that have this exact version of the plugin deployed are potentially vulnerable.

The vulnerability has a CVSS score of 6.5, indicating a moderate level of severity. The EPSS score is unavailable, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation evidence as of the data available. Based on the description, it is inferred that an attacker would need authenticated access with a role that can interact with the plugin, and can exploit the plugin’s endpoints directly through the WordPress admin or front‑end interface.