CVE-2025-31836: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was identified in the WordPress Review Manager plugin affecting versions through 2.2.0. The vulnerability was discovered by researcher LVT-tholv2k and was publicly disclosed on April 1, 2025. The issue has been assigned CVE-2025-31836 and relates to incorrectly configured access control security levels (Patchstack).

The vulnerability is classified as a Broken Access Control issue (CWE-862) with a CVSS v3.1 Base Score of 5.3 (Medium). The vulnerability vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating it can be exploited remotely with low attack complexity, requires no privileges or user interaction, and has a limited impact on integrity (Patchstack, NVD).

The vulnerability allows unprivileged users to execute certain higher privileged actions due to missing authorization, authentication, or nonce token checks. While classified as having a low severity impact, it could potentially lead to unauthorized access to privileged functions (Patchstack).

The vulnerability is considered to have low attack complexity and can be exploited by unauthenticated users. According to security assessments, it is unlikely to be exploited despite being remotely accessible (Patchstack).

As of the disclosure date, no official fix is available for this vulnerability. The issue affects Review Manager plugin versions up to 2.2.0, and virtual patching has been deemed unnecessary due to the low severity impact (Patchstack).