Security
Loading…

CVE-2026-94274

MEDIUMCVSS 5.3
View on NVD← Back to search
Description

The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer review records, including reviews still pending moderation, allowing unauthenticated attackers to harvest reviewers' email addresses and other non-public review content.

Timeline
Published:September 30th, 2026 6:17 AM
Last modified:September 30th, 2026 4:28 PM
CVSS Scoring

CVSS v3: 5.3 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)
CWE-200
References & Reports
Advisories, patches, and third-party reports

Source: NIST NVD · Data may lag official sources by up to one minute