Is CVE-2026-40781 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40781 being exploited in the wild.

How severe is CVE-2026-40781?

High severity, with a CVSS score of 7.5, published 15 June 2026.

Is there a fix for CVE-2026-40781?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-40781 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-40781?

Check whether you run WPDeveloper ReviewX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40781: ReviewX WordPress plugin authentication bypass

CVE-2026-40781 · Severity: high · CVSS 7.5 · Published 2026-06-15

ReviewX, a WordPress plugin used for managing customer reviews, contains a security flaw that allows unauthorized individuals to bypass authentication. An attacker could exploit this to perform actions typically reserved for administrators, potentially leading to a full takeover of the website. This could result in the loss of site control, unauthorized content changes, or disruption of business operations.

Vendors: WPDeveloper.

Quick answers

Is CVE-2026-40781 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40781 being exploited in the wild.
How severe is CVE-2026-40781?: High severity, with a CVSS score of 7.5, published 15 June 2026.
Which products and versions are affected?: WPDeveloper ReviewX <= 2.3.6.
Is there a fix for CVE-2026-40781?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-40781 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-40781?: Check whether you run WPDeveloper ReviewX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

ReviewX versions up to and including 2.3.6 are vulnerable to an authentication bypass (CWE-288) via an alternate path or channel. The vulnerability allows an unauthenticated remote attacker to bypass security checks and perform actions that should be restricted to high-privileged users. According to the advisory, this could lead to unauthorized administrative access to the WordPress site. The issue is resolved in version 2.3.7. The attack vector is network-based with low complexity and requires no user interaction or prior privileges.

Affected products

ReviewX ReviewX <= 2.3.6

Timeline

2026-03-11: other: Reported by Jakub Herman
2026-04-22: advisory: Initial Patchstack advisory published
2026-06-15: disclosed: NVD publication date

References

https://patchstack.com/database/wordpress/plugin/reviewx/vulnerability/wordpress-reviewx-plugin-2-3-6-broken-authentication-vulnerability?_s_id=cve

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.