CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in YetAnotherStarsRating.Com YASR – Yet Another Star Rating Plugin for WordPress.This issue affects YASR – Yet Another Star Rating Plugin for WordPress: from n/a through 3.3.8.
Explanation of Vulnerability in Simple Terms
YASR – Yet Another Star Rating Plugin for WordPress versions up to 3.3.8 contains a time-of-check-time-of-use (TOCTOU) race condition that allows an attacker to modify rating data. The vulnerability requires specific timing and network conditions to exploit but does not require authentication. Site administrators should update to a version newer than 3.3.8.
What an attacker can do
Modify star ratings or rating data through a race condition exploit.
Potential impact on your site
Star ratings on your site could be altered by an attacker without authentication, affecting review integrity.
Conditions required to exploit
Network access; attacker must exploit a timing window between data validation and storage.
Key dates
External resources
Related vulnerabilities
