PT-2026-1617 · WordPress · Reviewify

Itthidej Aramsri · Published 2026-01-07 · Updated 2026-02-02 · CVE-2025-14070

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Reviewify plugin for WordPress versions through 1.0.6

Description The Reviewify plugin for WordPress has a flaw that allows unauthorized modification of data. This is due to a missing capability check on the 'send test email' AJAX action. Authenticated attackers with Contributor-level access or higher can create arbitrary WooCommerce discount coupons, potentially leading to financial loss. The vulnerable component is the send test email AJAX action.

Recommendations Update the Reviewify plugin to a version newer than 1.0.6.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-14070

Affected Products

Reviewify

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-14070 · Security Note
• https://plugins.trac.wordpress.org/browser/review-for-discount/trunk/admin/class-xswcrd-review-discounts-admin.php#L425 · Note
• https://plugins.trac.wordpress.org/browser/review-for-discount/tags/1.0.6/admin/class-xswcrd-review-discounts-admin.php#L425 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/9db8756a-a177-4d39-b169-dc874cac2b3b?source=cve · Note
• https://twitter.com/CVEnew/status/2008838581125578807 · Twitter Post
• https://cwe.mitre.org/data/definitions/862.html · Note
• https://twitter.com/cracbot/status/2010668126296531391 · Twitter Post
• https://twitter.com/RedPacketSec/status/2008927792403005465 · Twitter Post
• https://twitter.com/DavidMarquet19/status/2018233146538414344 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3434387 · Note