CVE-2026-116559: A2Reviews <= 1.2.3 - Unauthenticated Plugin Data Modification and Disclosure

Q: Which sites are exposed to unauthenticated attacks?

A2Reviews installations through version 1.2.3 are exposed when they are unconnected and retain the default empty value used to key the API command signature. In that state, an unauthenticated attacker can invoke affected API command handlers.

Q: What can an unauthenticated attacker do?

An attacker can modify A2Reviews settings and product review metadata. They can also read non-public product metadata.

Q: How can I determine whether my installation is at particular risk?

Check whether A2Reviews is version 1.2.3 or earlier and whether the installation is unconnected with the signature-key value left empty. The described authorization weakness specifically relies on that default empty value.

Published Nov 15, 2026

Updated

The A2Reviews WordPress plugin through 1.2.3 does not properly verify authorization on several of its API command handlers, relying on a signature keyed on a value that is empty by default on an unconnected install, allowing unauthenticated attackers to modify A2Reviews WordPress plugin through 1.2.3 settings and product review metadata and to read non-public product metadata.

Affected Software

0 affected components

Event History

Nov 15, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:16 AM

Description

Frequently Asked Questions

Which sites are exposed to unauthenticated attacks?

A2Reviews installations through version 1.2.3 are exposed when they are unconnected and retain the default empty value used to key the API command signature. In that state, an unauthenticated attacker can invoke affected API command handlers.

What can an unauthenticated attacker do?

An attacker can modify A2Reviews settings and product review metadata. They can also read non-public product metadata.

How can I determine whether my installation is at particular risk?

Check whether A2Reviews is version 1.2.3 or earlier and whether the installation is unconnected with the signature-key value left empty. The described authorization weakness specifically relies on that default empty value.

CVE-2026-116559: A2Reviews <= 1.2.3 - Unauthenticated Plugin Data Modification and Disclosure

Affected Software

Event History

Frequently Asked Questions

Which sites are exposed to unauthenticated attacks?

What can an unauthenticated attacker do?

How can I determine whether my installation is at particular risk?

Company

Resources

Contact

Frequently Asked Questions

Which sites are exposed to unauthenticated attacks?

What can an unauthenticated attacker do?

How can I determine whether my installation is at particular risk?