Junglewise Threat Intelligence

CVE-2026-4301: Rate Star Review Vote WordPress plugin missing authorization in AJAX handler

CVE-2026-4301 · Severity: medium · CVSS 4.3 · Published 2026-05-12

Executive brief

A WordPress plugin used for adding star ratings and reviews to websites contains a security flaw that allows logged-in users to modify site content. By exploiting this, an attacker with basic account access can overwrite the title, content, and author of any post or page on the site. This could lead to unauthorized website changes, misinformation, or the loss of original content.

Technical details

The vwrsr_review() AJAX handler in the Rate Star Review Vote plugin lacks proper authorization and CSRF protection (nonces). While it checks if a user is logged in, it does not verify if the user has the permissions required to edit posts. When the 'form' parameter is set to 'update', the function accepts a user-supplied 'rating_id' and passes it to wp_update_post(). This allows an attacker with Subscriber-level access or higher to overwrite the title, content, author, and post_type of any post ID. Additionally, the handler calls update_post_meta() on the arbitrary ID, allowing for unauthorized metadata modification.

Affected products

  • Rate Star Review Vote Rate Star Review Vote - AJAX Reviews, Votes, Star Ratings Up to and including 1.6.4

Timeline

  • 2026-05-12: advisory: NVD publication date
  • 2026-05-12: disclosed: Wordfence disclosure date

References