// For flags

CVE-2024-32685

WordPress WP Ultimate Review plugin <= 2.2.5 - Review Score Manipulation vulnerability

Severity Score

5.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

Client-Side Enforcement of Server-Side Security vulnerability in Wpmet Wp Ultimate Review allows Functionality Bypass.This issue affects Wp Ultimate Review: from n/a through 2.2.5.

La vulnerabilidad de aplicación del lado del cliente de seguridad del lado del servidor en Wpmet Wp Ultimate Review permite omitir la funcionalidad. Este problema afecta a Wp Ultimate Review: desde n/a hasta 2.2.5.

The WP Ultimate Review plugin for WordPress is vulnerable to bypass review restrictions in all versions up to, and including, 2.2.5. This is due to the plugin not properly enforcing review restrictions. This makes it possible for unauthenticated attackers to review things multiple times.

*Credits: Kyle Sanchez (Patchstack Alliance)
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
None
Automatable
Yes
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2024-04-17 CVE Reserved
  • 2024-04-17 CVE Published
  • 2024-05-18 EPSS Updated
  • 2024-08-02 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-602: Client-Side Enforcement of Server-Side Security
  • CWE-862: Missing Authorization
CAPEC
  • CAPEC-554: Functionality Bypass
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Wp Ultimate Review
Search vendor "Wp Ultimate Review"
 Wp Ultimate Review
Search vendor "Wp Ultimate Review" for product "Wp Ultimate Review"
 >= 0.0.0 <= 2.2.5
Search vendor "Wp Ultimate Review" for product "Wp Ultimate Review" and version " >= 0.0.0 <= 2.2.5"
en
Affected