CVE-2026-40781 HIGH

CVE-2026-40781: WordPress ReviewX plugin <= 2.3.6 - Broken Authentication vulnerability

Vendor Reviewx
Product ReviewX
Weakness CWE-288
Published June 15, 2026
Last update June 16, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

What the vulnerability does

01Description

Unauthenticated Broken Authentication in ReviewX <= 2.3.6 versions.

Explanation of Vulnerability in Simple Terms

02Summary

ReviewX versions up to 2.3.6 contain an authentication bypass vulnerability that allows unauthenticated attackers to modify data on the site. The vulnerability stems from improper authentication checks in a critical function. No user interaction is required to exploit this issue. Update to version 2.3.7 or later.

What an attacker can do

03Attacker Capabilities

Modify site data without logging in or providing credentials.

Potential impact on your site

04Site Impact

Attackers can alter or corrupt data in ReviewX without any account, potentially affecting reviews, ratings, or other stored information.

Conditions required to exploit

05Prerequisites

Network access to the ReviewX installation; no authentication required.

Key dates

06Disclosure timeline

June 15, 2026 CVE published
June 16, 2026 Record updated