PT-2026-27049 · Unknown+1 · Woocommerce+1

Abrahack · Publicado 2026-03-23 · Atualizado 2026-03-24 · CVE-2025-10734

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress versions up to and including 2.2.12

Description The ReviewX plugin for WordPress is susceptible to exposure of sensitive information. Unauthenticated attackers can potentially extract sensitive data, including user names, emails, phone numbers, and addresses, through the syncedData function.

Recommendations Update the ReviewX plugin to a version later than 2.2.12.

Correção

Insecure Storage of Sensitive Information

Enumeração de Fraquezas

CWE-922

Identificadores relacionados

CVE-2025-10734

Produtos afetados

Reviewx

Woocommerce

Referências · 6

• https://wordfence.com/threat-intel/vulnerabilities/id/eb830ad3-50ba-4dfe-becb-351b227706c1?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/reviewx/tags/2.2.7/app/Rest/Controllers/DataSyncController.php#L77 · Nota
• https://twitter.com/CVEnew/status/2035992470924747148 · Publicação no Twitter
• https://twitter.com/CVEarity/status/2036439572402545034 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-10734 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2035999063653392833 · Publicação no Twitter