Is CVE-2026-57318 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57318 being exploited in the wild.

How severe is CVE-2026-57318?

Medium severity, with a CVSS score of 6.5, published 26 June 2026.

Which products and versions are affected?

Gemini Labs Site Reviews <= 8.0.11.

Is there a fix for CVE-2026-57318?

A patch was published on 2026-06-26: Version 8.0.12 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57318 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-57318?

Check whether you run Gemini Labs Site Reviews at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57318: Gemini Labs Site Reviews sensitive data exposure in WordPress plugin

Q: Is there a fix for CVE-2026-57318?

A patch was published on 2026-06-26: Version 8.0.12 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-57318 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-57318?

Check whether you run Gemini Labs Site Reviews at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57318 · Severity: medium · CVSS 6.5 · Published 2026-06-26

The Site Reviews plugin for WordPress, which allows websites to collect and display customer reviews, contains a security flaw that exposes sensitive information. An individual with a basic 'Subscriber' account can access data that should normally be restricted to site administrators. This exposure could lead to the leakage of private user details or internal system information, potentially aiding further attacks on the website.

Technologies: Gemini Labs Site Reviews. Vendors: Gemini Labs.

Quick answers

Is CVE-2026-57318 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57318 being exploited in the wild.
How severe is CVE-2026-57318?: Medium severity, with a CVSS score of 6.5, published 26 June 2026.
Which products and versions are affected?: Gemini Labs Site Reviews <= 8.0.11.
Is there a fix for CVE-2026-57318?: A patch was published on 2026-06-26: Version 8.0.12 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57318 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-57318?: Check whether you run Gemini Labs Site Reviews at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Site Reviews plugin for WordPress (versions <= 8.0.11) is vulnerable to an insertion of sensitive information into sent data (CWE-201). The flaw allows authenticated attackers with low-level 'Subscriber' privileges to access sensitive information that is not intended for their role. The vulnerability is exploited via a network request without requiring user interaction. The root cause involves improper data filtering or access control within the plugin's review management or display components. A fix is available in version 8.0.12.

Affected products

Gemini Labs Site Reviews <= 8.0.11

Timeline

2026-06-23: disclosed: Reported by Ananda Dhakal via Patchstack
2026-06-26: advisory: NVD and Patchstack published the advisory
2026-06-26: patched: Version 8.0.12 released to address the vulnerability

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.