{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24562", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-01-23T12:31:58.117Z", "datePublished": "2026-01-23T14:28:55.304Z", "dateUpdated": "2026-04-28T16:14:49.318Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "ryviu", "product": "Ryviu \u2013 Product Reviews for WooCommerce", "vendor": "Ryviu", "versions": [{"lessThanOrEqual": "3.1.26", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Legion Hunter | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-01T16:04:44.015Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in Ryviu Ryviu \u2013 Product Reviews for WooCommerce ryviu allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Ryviu \u2013 Product Reviews for WooCommerce: from n/a through <= 3.1.26.</p>"}], "value": "Missing Authorization vulnerability in Ryviu Ryviu \u2013 Product Reviews for WooCommerce ryviu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ryviu \u2013 Product Reviews for WooCommerce: from n/a through <= 3.1.26."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:49.318Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/ryviu/vulnerability/wordpress-ryviu-product-reviews-for-woocommerce-plugin-3-1-26-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress Ryviu \u2013 Product Reviews for WooCommerce plugin <= 3.1.26 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-23T19:53:48.799396Z", "id": "CVE-2026-24562", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T14:26:16.055Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24562", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-23T19:53:48.799396Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-23T19:53:30.684Z"}}], "cna": {"title": "WordPress Ryviu \u2013 Product Reviews for WooCommerce plugin <= 3.1.26 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Legion Hunter | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Ryviu", "product": "Ryviu &#8211; Product Reviews for WooCommerce", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.1.26"}], "packageName": "ryviu", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-28T13:26:23.303Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/ryviu/vulnerability/wordpress-ryviu-product-reviews-for-woocommerce-plugin-3-1-26-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Ryviu Ryviu &#8211; Product Reviews for WooCommerce ryviu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ryviu &#8211; Product Reviews for WooCommerce: from n/a through <= 3.1.26.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in Ryviu Ryviu &#8211; Product Reviews for WooCommerce ryviu allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Ryviu &#8211; Product Reviews for WooCommerce: from n/a through <= 3.1.26.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T12:10:45.292Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24562", "state": "PUBLISHED", "dateUpdated": "2026-04-28T14:26:16.055Z", "dateReserved": "2026-01-23T12:31:58.117Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-01-23T14:28:55.304Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Ryviu Ryviu \u2013 Product Reviews for WooCommerce ryviu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ryviu \u2013 Product Reviews for WooCommerce: from n/a through <= 3.1.26."}, {"lang": "es", "value": "Vulnerabilidad de autorizaci\u00f3n faltante en Ryviu Ryviu \u2013 Product Reviews para WooCommerce ryviu permite la explotaci\u00f3n de niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a Ryviu \u2013 Product Reviews para WooCommerce: desde n/a hasta &lt;= 3.1.26."}], "id": "CVE-2026-24562", "lastModified": "2026-04-28T19:36:50.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "audit@patchstack.com", "type": "Secondary"}]}, "published": "2026-01-23T15:16:13.643", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/ryviu/vulnerability/wordpress-ryviu-product-reviews-for-woocommerce-plugin-3-1-26-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-29T00:56:00.960332+00:00", "value": {"mitigation_remediation": ["Upgrade the Ryviu \u2013 Product Reviews for WooCommerce plugin to version 3.1.27 or later to remove the missing authorization checks.", "Revoke review creation, editing, and deletion permissions from non\u2011administrator roles to limit exposure.", "Verify that the WordPress installation enforces role\u2011based access controls, and restrict review functionality to trusted users only."], "summary": {"action": "Update Plugin", "impact": "Missing Authorization affecting review data integrity"}, "threat_synthesis": {"affected_systems": "The Ryviu \u2013 Product Reviews for WooCommerce WordPress plugin, versions from the earliest release through 3.1.26, is affected. Sites running any of these versions are vulnerable if visitors or low\u2011privilege users can access the review submission or editing features.", "description_and_impact": "A missing authorization check (CWE-862) in the Ryviu \u2013 Product Reviews for WooCommerce plugin permits users without proper privileges to manipulate review data. The flaw allows creation, modification, or deletion of customer reviews through the plugin\u2019s interface, potentially corrupting the site\u2019s feedback system. No capability for code execution or privilege escalation is listed, so the primary impact is limited to the integrity of review content and the trust customers place in the site\u2019s feedback mechanism.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate risk. The EPSS score is below 1%, suggesting a low probability of widespread exploitation. It is not listed in the CISA KEV catalog. The likely attack vector is through the standard review submission or editing interface of the plugin, potentially without authenticated access. The impact remains confined to the integrity of review data, with no disclosed path to more severe compromise."}}}}, "created": "2026-01-26T11:53:38.059346+00:00", "updated": "2026-04-29T01:00:11.405098+00:00", "vendors": ["ryviu", "ryviu$PRODUCT$product_reviews_for_woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}