{"id":"CVE-2026-116559","kind":"vulnerability","aliases":["CVE-2026-116559"],"related":[],"title":"A2Reviews WordPress plugin: unauthenticated users can change settings and read data","description":"The A2Reviews WordPress plugin through 1.2.3 does not properly verify authorization on several of its API command handlers, relying on a signature keyed on a value that is empty by default on an unconnected install, allowing unauthenticated attackers to modify A2Reviews WordPress plugin through 1.2.3 settings and product review metadata and to read non-public product metadata.","summary":"The A2Reviews WordPress plugin through 1.2.3 checks a signature keyed on a value that is empty by default on an unconnected install, so its API command handlers do not verify authorization properly. An unauthenticated attacker can change plugin settings and product review metadata and read non-public product metadata.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["a2reviews","other","wordpress"],"not_affected_if":["connected-account","plugin-not-installed"],"how_to_check":"- Check whether the A2Reviews plugin is installed and its version is `1.2.3` or earlier in the WordPress admin under Plugins.\n- Check whether the plugin is connected to an A2Reviews account; the flaw applies to unconnected installs where the key is empty by default.","fix":null,"status":"open","published_at":"2026-11-15T07:16:54+00:00","first_seen_at":"2026-11-15T07:36:11+00:00","triaged_at":"2026-11-15T07:36:23+00:00","updated_at":"2026-11-15T07:36:23+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-15T07:36:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"A2Reviews WordPress plugin: unauthenticated users can change settings and read data","impact":"medium","summary":"The A2Reviews WordPress plugin through 1.2.3 checks a signature keyed on a value that is empty by default on an unconnected install, so its API command handlers do not verify authorization properly. An unauthenticated attacker can change plugin settings and product review metadata and read non-public product metadata.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","a2reviews"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker changes plugin settings and reads non-public product metadata","analyst_note":"Confirm the fixed version and whether the default unconnected state is exposed; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-116559.","how_to_check":"- Check whether the A2Reviews plugin is installed and its version is `1.2.3` or earlier in the WordPress admin under Plugins.\n- Check whether the plugin is connected to an A2Reviews account; the flaw applies to unconnected installs where the key is empty by default.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","connected-account"],"who_is_affected":"Sites running the A2Reviews WordPress plugin version 1.2.3 or earlier, especially installs not connected to an A2Reviews account, since the weak check relies on a value that is empty by default. Sites without the plugin are not affected. The sources do not say which version fixes it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000757,"input_tokens":4568,"output_tokens":601,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-116559':14A,17A '-2026':13A,16A '1.2.3':26B,76C,115C 'a2reviews':1A,18B,22B,72C,111C 'allow':106C 'api':45B,86C 'attack':55B,108C 'author':51B,81C 'chang':7A,57B 'check':27B 'command':46B,87C 'cve':12A,15A 'data':11A 'default':38B,101C 'empti':36B,99C 'handler':47B,88C 'instal':42B,105C 'key':30B,93C 'metadata':63B,70B,120C,128C 'modifi':110C 'non':67B,125C 'non-publ':66B,124C 'plugin':3A,24B,58B,74C,113C 'product':61B,69B,118C,127C 'proper':52B,79C 'public':68B,126C 'read':10A,65B,123C 'reli':89C 'review':62B,119C 'set':8A,59B,116C 'sever':83C 'signatur':29B,92C 'unauthent':4A,54B,107C 'unconnect':41B,104C 'user':5A 'valu':33B,96C 'verifi':50B,80C 'wordpress':2A,20B,23B,73C,112C","nicknames":[],"mitigations":[],"who_affected":"Sites running the A2Reviews WordPress plugin version 1.2.3 or earlier, especially installs not connected to an A2Reviews account, since the weak check relies on a value that is empty by default. Sites without the plugin are not affected. The sources do not say which version fixes it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["a2reviews","medium","other","wordpress"],"campaign_type":null,"search_a":"'-116559':14A,17A '-2026':13A,16A 'a2reviews':1A 'chang':7A 'cve':12A,15A 'data':11A 'plugin':3A 'read':10A 'set':8A 'unauthent':4A 'user':5A 'wordpress':2A","search_b":"'1.2.3':26B 'a2reviews':18B,22B 'api':45B 'attack':55B 'author':51B 'chang':57B 'check':27B 'command':46B 'default':38B 'empti':36B 'handler':47B 'instal':42B 'key':30B 'metadata':63B,70B 'non':67B 'non-publ':66B 'plugin':24B,58B 'product':61B,69B 'proper':52B 'public':68B 'read':65B 'review':62B 'set':59B 'signatur':29B 'unauthent':54B 'unconnect':41B 'valu':33B 'verifi':50B 'wordpress':20B,23B","search_c":"'1.2.3':76C,115C 'a2reviews':72C,111C 'allow':106C 'api':86C 'attack':108C 'author':81C 'command':87C 'default':101C 'empti':99C 'handler':88C 'instal':105C 'key':93C 'metadata':120C,128C 'modifi':110C 'non':125C 'non-publ':124C 'plugin':74C,113C 'product':118C,127C 'proper':79C 'public':126C 'read':123C 'reli':89C 'review':119C 'set':116C 'sever':83C 'signatur':92C 'unauthent':107C 'unconnect':104C 'valu':96C 'verifi':80C 'wordpress':73C,112C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T07:16:54+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116559","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116559","severity":null,"published_at":"2026-11-15T07:16:54+00:00","modified_at":"2026-11-15T07:16:54+00:00","first_seen_at":"2026-11-15T07:36:11+00:00","fetched_at":"2026-11-15T07:36:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}