Security Alert Summary
The ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress contains a sensitive information exposure vulnerability (CVE-2025-10734). In affected versions up to and including 2.2.12, an unauthenticated attacker can use the syncedData function to extract sensitive user data such as names, email addresses, phone numbers, and physical addresses.
CVE Details
- CVE ID: CVE-2025-10734
- Affected component: ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress
- Affected versions: All versions up to and including 2.2.12
- Published: March 23, 2026 6:16 AM UTC
- Last modified: March 23, 2026 2:31 PM UTC
- CVSS v3.1: Base Score 5.3, Severity MEDIUM, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Authentication / Privileges / User interaction: No authentication required; Privileges required: None; User interaction: None
- Primary impact: Confidentiality: Low (exposure of user data); Integrity: None; Availability: None
- CWE: CWE-922
Technical Details
The vulnerability is a sensitive information exposure in the plugin’s data synchronization functionality. According to the advisory, the issue is reachable via the syncedData function. The plugin’s REST controller implementation (referenced in the plugin codebase as app/Rest/Controllers/DataSyncController.php) exposes data that allows unauthenticated requests to retrieve user-identifying fields.
Because the endpoint and function do not require authentication or privileges, an attacker can query the affected functionality over the network and obtain user names, email addresses, phone numbers, and addresses. The impact is limited to disclosure of those fields; the CVSS metrics indicate no integrity or availability impact.
How This Could Impact Your Website
Consider a small e-commerce site using ReviewX where the site owner, a few internal staff members, and an external contractor each have different roles. If an attacker is able to extract user contact details through the vulnerable syncedData functionality, those exposed emails and phone numbers could be used for targeted phishing or social engineering against staff or customers. An attacker might craft convincing emails that reference known customers or internal staff, increasing the likelihood of successful scams. Personal contact details exposed in this way can also raise privacy and regulatory concerns for your organization.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and other low-privilege accounts that may expose additional data.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual requests to REST endpoints or unexpected data exports.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
