CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The WordPress Review & Structure Data Schema Plugin – Review Schema plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the rtrs_review_edit() function in all versions up to, and including, 2.1.14. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary reviews.
Explanation of Vulnerability in Simple Terms
The Review Schema plugin for WordPress contains a missing authorization check that allows authenticated users with low privileges to modify data they should not have access to. An attacker with a basic user account can alter review schema information without proper permission validation. This affects all versions up to 2.1.14. Update to a version newer than 2.1.14 to resolve the issue.
What an attacker can do
Modify review schema data without proper authorization checks.
Potential impact on your site
Unauthorized users can alter review schema settings, potentially corrupting structured data or misleading search engines.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
