CVE-2026-116559 · Other
NO FIX YET
The A2Reviews WordPress plugin through 1.2.3 checks a signature keyed on a value that is empty by default on an unconnected install, so its API command handlers do not verify authorization properly. An unauthenticated attacker can change plugin settings and product review metadata and read non-public product metadata.
first public Nov 15, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the A2Reviews WordPress plugin version 1.2.3 or earlier, especially installs not connected to an A2Reviews account, since the weak check relies on a value that is empty by default. Sites without the plugin are not affected. The sources do not say which version fixes it.
Not affected if connected-account, plugin-not-installed
Who cares a2reviews, wordpress
1.2.3 or earlier in the WordPress admin under Plugins.No fix yet, per the sources.
The A2Reviews WordPress plugin through 1.2.3 does not properly verify authorization on several of its API command handlers, relying on a signature keyed on a value that is empty by default on an unconnected install, allowing unauthenticated attackers to modify A2Reviews WordPress plugin through 1.2.3 settings and product review metadata and to read non-public product metadata.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.