CVE-2025-10734: 
WordPress vulnerability analysis and mitigation

CVE-2025-10734 is a Sensitive Information Exposure vulnerability in the ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress. It affects all versions up to and including 2.2.12, allowing unauthenticated attackers to extract sensitive user data such as names, emails, phone numbers, and addresses via the syncedData function. The vulnerability was published on March 23, 2026, and assigned by Wordfence. It carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-922 (Insecure Storage of Sensitive Information) and stems from insufficient access controls on the syncedData function within the plugin's DataSyncController.php. Because no authentication or authorization check is enforced before the function executes, any remote, unauthenticated attacker can send a crafted network request to trigger the endpoint and receive sensitive user data in the response. The vulnerable code path is visible in the plugin's source at app/Rest/Controllers/DataSyncController.php (Wordfence, Plugin Source).

Successful exploitation allows unauthenticated remote attackers to exfiltrate sensitive personal information stored by the ReviewX plugin, including customer usernames, email addresses, phone numbers, and physical addresses. This constitutes a confidentiality breach with no impact on integrity or availability. The exposed data could be leveraged for phishing campaigns, credential stuffing, or social engineering attacks against affected WooCommerce store customers (Wordfence, ENISA EUVD).

No public exploit code or active in-the-wild exploitation has been confirmed at this time. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the lack of authentication requirement makes it trivially exploitable by any attacker who can reach the WordPress REST API endpoint (Wordfence).

1. Reconnaissance: Identify WordPress sites running the ReviewX plugin (versions ≤ 2.2.12) using tools like WPScan, Shodan, or Google dorks targeting plugin-specific paths.
2. Locate the vulnerable endpoint: Identify the REST API route registered by DataSyncController.php that exposes the syncedData function — typically accessible via the WordPress REST API base URL (e.g., /wp-json/).
3. Send unauthenticated request: Issue an HTTP GET or POST request to the vulnerable endpoint without any authentication headers or cookies.
4. Extract sensitive data: Parse the JSON response, which may contain customer usernames, email addresses, phone numbers, and physical addresses stored by the WooCommerce/ReviewX plugin (Wordfence, Plugin Source).

• Network: Unusual unauthenticated HTTP requests to WordPress REST API endpoints associated with the ReviewX plugin (e.g., paths containing reviewx or syncedData); repeated requests from a single IP to these endpoints.
• Logs: WordPress access logs showing GET/POST requests to /wp-json/reviewx/... or similar REST routes without authentication tokens; high-frequency requests from automated tools (e.g., consistent User-Agent strings like WPScan or generic curl/python agents).
• Application: Unexpected spikes in REST API traffic to ReviewX-related endpoints visible in server or WAF logs.

Site administrators should update the ReviewX plugin to a version beyond 2.2.12 that includes a fix for this vulnerability. Until a patched version is available or applied, consider disabling the ReviewX plugin or restricting access to the WordPress REST API using a Web Application Firewall (WAF) rule that blocks unauthenticated requests to ReviewX-specific endpoints. Monitoring REST API access logs for anomalous unauthenticated requests to plugin endpoints is also recommended as a detective control (Wordfence).

The vulnerability was noted on Bluesky via automated CVE tracking accounts shortly after publication. Coverage has been limited to vulnerability aggregation platforms and security intelligence feeds, with no significant vendor statements or notable researcher commentary beyond the initial Wordfence disclosure (Wordfence).