---
id: "CVE-2026-110366"
kind: "vulnerability"
aliases: ["CVE-2026-110366"]
title: "Site Reviews WordPress plugin: missing authorization check exposes review data"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "site-reviews", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-16T07:17:11+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T04:28:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110366", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# Site Reviews WordPress plugin: missing authorization check exposes review data

The Site Reviews WordPress plugin by Gemini Labs has a missing authorization check that allows access control to be bypassed. An attacker who can reach the site may be able to perform actions or read data they should not be allowed to.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Site Reviews plugin version in the WordPress admin under Plugins, or with `wp plugin get site-reviews --field=version`
- Confirm whether the installed version is at or below `8.3.4`

## Fix

- Update the Site Reviews plugin to a version later than `8.3.4`, as published by the vendor (fixed version not stated in the sources)

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110366

## From the sources

Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through 8.3.4.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_