{"id":"CVE-2026-110366","kind":"vulnerability","aliases":["CVE-2026-110366"],"related":[],"title":"Site Reviews WordPress plugin: missing authorization check exposes review data","description":"Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through 8.3.4.","summary":"The Site Reviews WordPress plugin by Gemini Labs has a missing authorization check that allows access control to be bypassed. An attacker who can reach the site may be able to perform actions or read data they should not be allowed to.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","site-reviews","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Site Reviews plugin version in the WordPress admin under Plugins, or with `wp plugin get site-reviews --field=version`\n- Confirm whether the installed version is at or below `8.3.4`","fix":"- Update the Site Reviews plugin to a version later than `8.3.4`, as published by the vendor (fixed version not stated in the sources)","status":"open","published_at":"2026-10-16T07:17:11+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T04:28:37+00:00","updated_at":"2026-10-25T04:28:37+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:28:37Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Site Reviews plugin to a version later than `8.3.4`, as published by the vendor (fixed version not stated in the sources)","reach":"internet","title":"Site Reviews WordPress plugin: missing authorization check exposes review data","impact":"medium","summary":"The Site Reviews WordPress plugin by Gemini Labs has a missing authorization check that allows access control to be bypassed. An attacker who can reach the site may be able to perform actions or read data they should not be allowed to.","category":"package","nicknames":[],"who_cares":["wordpress","site-reviews"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unauthorized actions or data access within the plugin's review functions","analyst_note":"Check the vendor advisory or the Wordfence/WPScan entry for the fixed version, required privileges and the exact endpoint affected.","how_to_check":"- Check the installed Site Reviews plugin version in the WordPress admin under Plugins, or with `wp plugin get site-reviews --field=version`\n- Confirm whether the installed version is at or below `8.3.4`","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Site Reviews WordPress plugin version 8.3.4 or earlier. The sources do not describe which configurations or roles are required, so the exposure scope is unknown. Sites that do not have the plugin installed are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000601,"input_tokens":3306,"output_tokens":540,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110366':13A,16A '-2026':12A,15A '8.3.4':89C 'abl':51B 'access':37B,78C 'action':54B 'affect':83C 'allow':36B,62B,74C 'attack':43B 'author':6A,33B,64C 'bypass':41B 'check':7A,34B 'configur':77C 'control':38B,79C 'cve':11A,14A 'data':10A,57B 'exploit':75C 'expos':8A 'gemini':28B,67C 'incorrect':76C 'issu':82C 'lab':29B,68C 'levels.this':81C 'may':49B 'miss':5A,32B,63C 'n/a':87C 'packag':17B 'perform':53B 'plugin':4A,26B 'reach':46B 'read':56B 'review':2A,9A,20B,24B,70C,73C,85C 'secur':80C 'site':1A,19B,23B,48B,69C,72C,84C 'site-review':18B,71C 'vulner':65C 'wordpress':3A,21B,25B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Site Reviews WordPress plugin version 8.3.4 or earlier. The sources do not describe which configurations or roles are required, so the exposure scope is unknown. Sites that do not have the plugin installed are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T07:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110366","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110366","severity":null,"published_at":"2026-10-16T07:17:11+00:00","modified_at":"2026-10-16T15:19:36+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}