CyberRota Analysis
AI-GeneratedThe Site Reviews WordPress plugin versions prior to 8.3.0 are vulnerable due to improper handling of request data, allowing unauthenticated users to inject arbitrary PHP objects. This could lead to potential exploitation depending on the site's configuration and other installed code, posing a risk to the integrity and security of the affected WordPress installations. WordPress site administrators using this plugin should prioritize updating to version 8.3.0 or later to mitigate this vulnerability.
Original NVD Description
The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or too short to be secret. This allows unauthenticated users to inject arbitrary PHP objects on such installs. The Site Reviews WordPress plugin before 8.3.0's own code contains no chain onward from the injected object, so how far it reaches depends on the other code present on the site.