---
id: "CVE-2026-116559"
page: "https://infrastack.ai/live/CVE-2026-116559"
kind: "vulnerability"
aliases: ["CVE-2026-116559"]
title: "A2Reviews WordPress plugin: unauthenticated users can change settings and read data"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["a2reviews", "other", "wordpress"]
not_affected_if: ["connected-account", "plugin-not-installed"]
published_at: "2026-11-15T07:16:54+00:00"
first_seen_at: "2026-11-15T07:36:11+00:00"
updated_at: "2026-11-15T07:36:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116559", "first_seen_at": "2026-11-15T07:36:11+00:00"}]
exploit_sources: []
---

# A2Reviews WordPress plugin: unauthenticated users can change settings and read data

Link for people: https://infrastack.ai/live/CVE-2026-116559 (this .md is for agents)

The A2Reviews WordPress plugin through 1.2.3 checks a signature keyed on a value that is empty by default on an unconnected install, so its API command handlers do not verify authorization properly. An unauthenticated attacker can change plugin settings and product review metadata and read non-public product metadata.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the A2Reviews plugin is installed and its version is `1.2.3` or earlier in the WordPress admin under Plugins.
- Check whether the plugin is connected to an A2Reviews account; the flaw applies to unconnected installs where the key is empty by default.

## Timeline

- 2026-11-15T07:36:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116559

## From the sources

The A2Reviews WordPress plugin through 1.2.3 does not properly verify authorization on several of its API command handlers, relying on a signature keyed on a value that is empty by default on an unconnected install, allowing unauthenticated attackers to modify A2Reviews WordPress plugin through 1.2.3 settings and product review metadata and to read non-public product metadata.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_