Site Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Injection via Form Signature
Summary
| CVE | CVE-2026-82925 |
|---|---|
| State | PUBLISHED |
| Assigner | WPScan |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-10 07:17:03 UTC |
| Updated | 2026-09-10 07:17:03 UTC |
| Description | The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or too short to be secret. This allows unauthenticated users to inject arbitrary PHP objects on such installs. The Site Reviews WordPress plugin before 8.3.0's own code contains no chain onward from the injected object, so how far it reaches depends on the other code present on the site. |
Risk And Classification
Problem Types: CWE-502 Deserialization of Untrusted Data
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Unknown | Site Reviews | affected 7.2.2 8.3.0 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| wpscan.com/vulnerability/bce47707-b60c-42a7-8817-89b1483f41a3 | [email protected] | wpscan.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Jakub Herman (en)
CNA: WPScan (en)
There are currently no legacy QID mappings associated with this CVE.