PT-2023-20613 · WordPress · Reviewx Wordpress Plugin

Published 2023-02-23 · Updated 2023-04-13 · CVE-2023-26325

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ReviewX WordPress Plugin versions prior to 1.6.4

Description The issue affects the 'rx export review' action in the ReviewX WordPress Plugin, where an authenticated SQL injection vulnerability exists in the filterValue and selectedColumns parameters.

Recommendations For ReviewX WordPress Plugin versions prior to 1.6.4, update to version 1.6.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the 'rx export review' action until a patch is available. Avoid using the filterValue and selectedColumns parameters in the affected action until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-26325

Affected Products

Reviewx Wordpress Plugin

References · 4

• 🔥 https://tenable.com/security/research/tra-2023-2 · Exploit
• https://osv.dev/vulnerability/CVE-2023-26325 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26325 · Security Note
• https://t.me/cibsecurity/58817 · Telegram Post