CVE-2025-10736: 
WordPress vulnerability analysis and mitigation

CVE-2025-10736 is an improper authorization vulnerability in the ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress. The flaw exists in all versions up to and including 2.2.10, allowing unauthenticated attackers to access protected REST API endpoints and extract or modify user data and plugin configuration. It was published on March 23, 2026, and assigned a CVSS v3.1 base score of 6.5 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-285 (Improper Authorization), specifically due to insufficient authorization checks in the userAccessibility() function within the plugin's AuthMiddleware.php file. Because this middleware fails to properly validate caller identity, unauthenticated network requests can bypass access controls and reach REST API endpoints that should be restricted to authenticated users. No user interaction or special privileges are required, and the attack can be conducted entirely over the network (Wordfence, WordPress Trac).

Successful exploitation allows unauthenticated attackers to read sensitive user information and alter plugin configuration settings on affected WordPress/WooCommerce sites. The confidentiality and integrity impacts are both rated low, with no direct availability impact; however, exposure of user data (such as email addresses or review-related account details) and the ability to modify plugin settings could facilitate further attacks such as spam campaigns, review manipulation, or reconnaissance for privilege escalation (Wordfence, ENISA EUVD).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.043%, indicating a low probability of exploitation in the near term (Wordfence).

1. Reconnaissance: Identify WordPress sites running the ReviewX plugin (versions ≤ 2.2.10) using tools like WPScan, Shodan, or by checking publicly accessible plugin metadata at wp-content/plugins/reviewx/.
2. Enumerate REST API endpoints: Query the WordPress REST API discovery endpoint (/wp-json/) to enumerate available routes registered by the ReviewX plugin.
3. Send unauthenticated requests: Craft HTTP GET or POST requests directly to ReviewX REST API endpoints (e.g., those under /wp-json/reviewx/v1/) without providing authentication credentials or nonces.
4. Bypass authorization: The userAccessibility() function in AuthMiddleware.php fails to enforce proper access control, so the request proceeds as if authorized.
5. Extract or modify data: Read user-related data (e.g., reviewer profiles, email addresses) or modify plugin configuration settings via the unprotected endpoints (Wordfence, WordPress Trac).

• Network: Unusual unauthenticated HTTP requests to WordPress REST API endpoints prefixed with /wp-json/reviewx/v1/ from external IP addresses, particularly GET or POST requests without valid authentication headers or nonces.
• Logs: WordPress access logs showing repeated requests to ReviewX REST API routes from the same IP without corresponding login events; HTTP 200 responses to API calls that should require authentication.
• File System: Unexpected changes to ReviewX plugin configuration files or database entries related to plugin settings that do not correspond to administrator actions.

Site administrators should update the ReviewX plugin to a version beyond 2.2.10 that includes a fix for the userAccessibility() authorization check. Until a patched version is available or applied, consider disabling the ReviewX plugin or restricting access to WordPress REST API endpoints via a web application firewall (WAF) rule blocking unauthenticated requests to /wp-json/reviewx/ routes. Monitor the official WordPress plugin repository and Wordfence advisories for patch availability (Wordfence, Wordfence Weekly Report).

Wordfence reported this vulnerability as part of their weekly WordPress vulnerability intelligence report for the week of March 16–22, 2026, and assigned it a medium severity rating (Wordfence Weekly Report). No significant broader media coverage or notable researcher commentary beyond the initial Wordfence disclosure has been identified.