CVE-2022-2108 MEDIUM

CVE-2022-2108: Wbcom Designs – BuddyPress Group Reviews <= 2.8.3 - Unauthorized AJAX Actions due to Nonce Bypass

Vendor Wbcomdesigns
Product Wbcom Designs – BuddyPress Group Reviews
Weakness CWE-862 · Missing authorization
Published July 18, 2022
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

The plugin Wbcom Designs – BuddyPress Group Reviews for WordPress is vulnerable to unauthorized settings changes and review modification due to missing capability checks and improper nonce checks in several functions related to said actions in versions up to, and including, 2.8.3. This makes it possible for unauthenticated attackers to modify reviews and plugin settings on the affected site.

Key dates

02Disclosure timeline

July 18, 2022 CVE published
April 8, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-24654 WordPress Squirrly SEO plugin <= 12.4.07 - Broken Access Control vulnerability CVE-2024-12331 File Manager Pro – Filester <= 1.8.6 - Missing Authorization to Authenticated (Subscriber+) Filebird Plugin Installation CVE-2025-39390 WordPress Booking and Rental Manager plugin <= 2.3.6 - Broken Access Control vulnerability CVE-2023-37870 WordPress WooCommerce Warranty Requests plugin <= 2.1.9 - Broken Access Control vulnerability CVE-2026-39606 WordPress BizReview plugin <= 1.5.13 - Broken Access Control vulnerability