CVE-2025-10734

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10734", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-19T14:55:16.957Z", "datePublished": "2026-03-23T05:29:39.286Z", "dateUpdated": "2026-04-08T17:31:13.762Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:31:13.762Z"}, "affected": [{"vendor": "reviewx", "product": "ReviewX \u2013 Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.2.12", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The ReviewX \u2013 WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.12 via the syncedData function. This makes it possible for unauthenticated attackers to extract sensitive data including user names, emails, phone numbers, addresses."}], "title": "ReviewX \u2013 WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Sensitive Information Exposure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/eb830ad3-50ba-4dfe-becb-351b227706c1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/reviewx/tags/2.2.7/app/Rest/Controllers/DataSyncController.php#L77"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-922 Insecure Storage of Sensitive Information", "cweId": "CWE-922", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "abrahack"}], "timeline": [{"time": "2025-09-05T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-11-19T16:49:00.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-22T16:26:54.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-23T15:17:50.320955Z", "id": "CVE-2025-10734", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T15:52:55.005Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10734", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-23T15:17:50.320955Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T15:17:51.310Z"}}], "cna": {"title": "ReviewX \u2013 WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Sensitive Information Exposure", "credits": [{"lang": "en", "type": "finder", "value": "abrahack"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "reviewx", "product": "ReviewX \u2013 Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.2.12"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-05T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-11-19T16:49:00.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-03-22T16:26:54.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/eb830ad3-50ba-4dfe-becb-351b227706c1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/reviewx/tags/2.2.7/app/Rest/Controllers/DataSyncController.php#L77"}], "descriptions": [{"lang": "en", "value": "The ReviewX \u2013 WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.12 via the syncedData function. This makes it possible for unauthenticated attackers to extract sensitive data including user names, emails, phone numbers, addresses."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-922", "description": "CWE-922 Insecure Storage of Sensitive Information"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:31:13.762Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10734", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:31:13.762Z", "dateReserved": "2025-09-19T14:55:16.957Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-23T05:29:39.286Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ReviewX \u2013 Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema", "vendor": "reviewx", "versions": [{"lessThanOrEqual": "2.2.12", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The ReviewX \u2013 WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.12 via the syncedData function. This makes it possible for unauthenticated attackers to extract sensitive data including user names, emails, phone numbers, addresses."}, {"lang": "es", "value": "El plugin ReviewX \u2013 WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema &amp; More para WordPress es vulnerable a la Exposici\u00f3n de Informaci\u00f3n Sensible en todas las versiones hasta la 2.2.12, inclusive, a trav\u00e9s de la funci\u00f3n syncedData. Esto permite que atacantes no autenticados extraigan datos sensibles, incluyendo nombres de usuario, correos electr\u00f3nicos, n\u00fameros de tel\u00e9fono, direcciones."}], "id": "CVE-2025-10734", "lastModified": "2026-06-17T08:28:51.670", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10734", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-23T15:17:50.320955Z", "version": "2.0.3"}}]}, "published": "2026-03-23T06:16:18.307", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/reviewx/tags/2.2.7/app/Rest/Controllers/DataSyncController.php#L77"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/eb830ad3-50ba-4dfe-becb-351b227706c1?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-922"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.2.12]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "ReviewX \u2013 Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema", "source": "cna", "vendor": "reviewx"}, "product": "reviewx_\u2013_multi-criteria_reviews_for_woocommerce_with_google_reviews_&_schema", "vendor": "reviewx"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-23T06:50:45.961200+00:00", "value": {"mitigation_remediation": ["Update the ReviewX plugin to a version newer than 2.2.12 if one is available. ", "If an update cannot be applied immediately, restrict access to the syncedData endpoint by disabling it in the plugin settings or blocking the endpoint with a web\u2011application firewall. ", "Verify that the endpoint no longer returns sensitive data by testing from an external network or performing a security scan. ", "Monitor WordPress logs and web traffic for unexpected requests to the syncedData endpoint and review logs for signs of data exfiltration."], "summary": {"action": "Immediate Patch", "impact": "Sensitive Information Exposure"}, "threat_synthesis": {"affected_systems": "Any WordPress site running the ReviewX plugin version 2.2.12 or earlier is impacted. The vulnerability resides in the plugin\u2019s REST controller that synchronizes review data; therefore, WooCommerce sites that rely on this plugin for product reviews must review their plugin version and configuration. Versions newer than 2.2.12 are assumed to have addressed the flaw, although the exact revision is not specified.", "description_and_impact": "The ReviewX \u2014 WooCommerce Product Reviews plugin is vulnerable to sensitive information exposure in all versions up to and including 2.2.12 through its syncedData function. This flaw allows unauthenticated users to retrieve personal data such as user names, email addresses, phone numbers, and mailing addresses, exposing confidential customer information and increasing the risk of privacy violations or phishing attacks. The weakness is classified as CWE\u2011922, reflecting improper handling of sensitive data.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity. No EPSS score is available, and the vulnerability is not cataloged in CISA\u2019s KEV list, suggesting no large\u2011scale exploitation reports yet. The attack vector is inferred to be public and unauthenticated: an attacker only needs to access the syncedData endpoint from outside the site. No credentials or further privileges are required, making exploitation straightforward for anyone with internet access."}}}}, "created": "2026-03-23T09:45:22.787988+00:00", "updated": "2026-03-25T14:49:41.975063+00:00", "vendors": ["reviewx", "reviewx$PRODUCT$reviewx_\u2013_multi-criteria_reviews_for_woocommerce_with_google_reviews_&_schema", "wordpress", "wordpress$PRODUCT$wordpress"]}