Security Alert Summary
The Site Reviews WordPress plugin (versions before 8.3.0) contains a deserialization weakness that can allow unauthenticated users to inject arbitrary PHP objects on installs where the site key is absent, left at its sample value, or short enough to be guessable. The plugin derives a key for protecting request data from the site’s nonce key in a way that makes the protection computable in those cases. The plugin’s own code does not include an apparent onward execution chain from the injected object; the real impact depends on other code present on the site.
CVE Details
- CVE ID:
CVE-2026-82925 - Affected component: Site Reviews WordPress plugin
- Affected versions: Versions before 8.3.0 (examples include 7.2.2 as listed)
- Published: September 10, 2026 at 7:17:03 AM UTC
- Last modified: September 10, 2026 at 3:13:07 PM UTC
- CVSS v3.1 base score: 8.1 (HIGH)
- CVSS v3.1 vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Authentication/Privileges/User Interaction: No privileges required (PR:N); no user interaction required (UI:N); network attack vector (AV:N); attack complexity high (AC:H)
- Primary impact: Confidentiality: High; Integrity: High; Availability: High
- Weakness: CWE-502 (Deserialization of Untrusted Data)
- SSVC notes: Exploitation: none; Automatable: no; Technical impact: total; Role: CISA Coordinator (as provided in SSVC data)
Technical Details
The plugin does not prevent request data from being deserialized and derives the key protecting that data by padding the site’s WordPress nonce key. On installs where that key is absent, left at the sample value, or is too short to be secret, the derived key becomes publicly computable. This allows unauthenticated users to supply serialized data that will be deserialized by the plugin, resulting in injection of arbitrary PHP objects.
The report notes that Site Reviews version < 8.3.0 allows object injection but that the plugin’s own code contains no explicit execution chain from the injected object. Therefore the potential for further impact depends on other installed code (themes, plugins, or custom code) that might use deserialized objects in a dangerous way.
How This Could Impact Your Website
Consider a small business WordPress site with a site owner, an internal editor, and an external contractor who contributes content. If the site is running an affected version of the Site Reviews plugin and the site key is missing or left at a default/sample value, an unauthenticated attacker could inject crafted PHP objects via requests that reach the plugin’s deserialization logic. Depending on other code present, this could lead to disclosure of site data or manipulation of application behavior.
Realistic consequences include exposure of internal user email addresses and other data accessible to PHP objects, and an increased risk of targeted phishing or social engineering against staff and contractors using those addresses. If the site contains other plugins or custom code that assumes safe deserialized objects, those components could be leveraged to escalate impact.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level and lower-privileged accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and themes to reduce the attack surface.
- Monitor site activity and logs for unusual behavior, particularly unexpected requests or deserialization events.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
