CVE-2026-25318: 
WordPress vulnerability analysis and mitigation

CVE-2026-25318 is a Missing Authorization (Broken Access Control) vulnerability in the WiserReview Product Reviews for WooCommerce WordPress plugin developed by Wisernotify. It affects all versions up to and including 2.9, and was patched in version 3.0. The vulnerability was reported on December 27, 2025, and published on January 26, 2026. It carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack, Feedly).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the appropriate permissions before executing certain privileged actions (Feedly). An authenticated attacker with low-level privileges (e.g., a Subscriber-level WordPress account) can exploit incorrectly configured access control security levels to perform actions beyond their intended authorization scope. The attack is network-based, requires no user interaction, and has low attack complexity, making it straightforward to exploit for any authenticated user (Patchstack).

Successful exploitation results in a limited integrity impact — an authenticated low-privileged user can perform unauthorized actions within the WooCommerce product review functionality, such as manipulating review data or settings beyond their permitted scope. There is no confidentiality or availability impact associated with this vulnerability. The scope is limited to the affected WordPress/WooCommerce installation, with no evidence of lateral movement potential (Patchstack, Feedly).

The vulnerability requires an authenticated account with at least Subscriber-level privileges, limiting opportunistic exploitation to registered users of the affected WordPress site. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of active exploitation in the wild (Feedly). There is no known public proof-of-concept exploit code, no evidence of in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority with unlikely exploitation impact (Patchstack).

The vendor (Wisernotify) has released version 3.0 of the WiserReview Product Reviews for WooCommerce plugin, which resolves this vulnerability. Site administrators should update the plugin to version 3.0 or later immediately via the WordPress admin dashboard. If an immediate update is not possible, restricting user registration or limiting Subscriber-level access on the site can reduce exposure until the patch is applied (Patchstack).

Patchstack, which coordinated the disclosure, classifies this as a low-priority vulnerability with unlikely exploitation impact, and credits researcher "Legion Hunter" for the discovery and responsible disclosure on December 27, 2025 (Patchstack). No significant broader media coverage or notable researcher commentary beyond the Patchstack advisory has been identified.