CVE-2024-0836: WordPress Review & Structure Data Schema Plugin – Review Schema <= 2.1.14 - Missing Authorization to Arbitrary Review Update
The WordPress Review & Structure Data Schema Plugin – Review Schema plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the rtrsreviewedit() function in all versions up to, and including, 2.1.14. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary reviews.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0836?
CVE-2024-0836 is considered a medium severity vulnerability due to the potential for unauthorized data modification.
How do I fix CVE-2024-0836?
To fix CVE-2024-0836, update the WordPress Review Schema plugin to version 2.1.15 or later.
Who is affected by CVE-2024-0836?
All users of the WordPress Review Schema plugin up to and including version 2.1.14 are affected by CVE-2024-0836.
What type of vulnerability is CVE-2024-0836?
CVE-2024-0836 is an unauthorized modification vulnerability due to a missing capability check.
When was CVE-2024-0836 reported?
CVE-2024-0836 was reported in early 2024, affecting all versions of the plugin up to 2.1.14.