CVE-2026-82925 Details
Description
The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or too short to be secret. This allows unauthenticated users to inject arbitrary PHP objects on such installs. The Site Reviews WordPress plugin before 8.3.0's own code contains no chain onward from the injected object, so how far it reaches depends on the other code present on the site.
A vulnerability allowing unauthenticated PHP object injection has been identified in the Site Reviews WordPress plugin, affecting versions prior to 8.3.0. The issue arises because the plugin does not properly prevent request data from being deserialized. It generates the key for protecting that data by padding the site's WordPress nonce key, making the key publicly computable on installations where the nonce key is absent, set to its default value, or too short to be secure. This flaw enables unauthenticated users to inject arbitrary PHP objects on vulnerable installations. The injected object’s impact is contingent on the existing code on the site, as the plugin does not provide a direct execution chain from the injected object.
Users are advised to update the Site Reviews WordPress plugin to version 8.3.0 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 10, 2026CISA-ADP
Assessed Sep 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/bce47707-b60c-42a7-8817-89b1483f41a3/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Site Reviews | >= 7.2.2, <= 8.2.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 10, 2026 | CVE Modified | CISA-ADP |
| Sep 10, 2026 | New CVE Received | [email protected] |