CVE-2026-82925: Site Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Injection via Form Signature
The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or too short to be secret. This allows unauthenticated users to inject arbitrary PHP objects on such installs. The Site Reviews WordPress plugin before 8.3.0's own code contains no chain onward from the injected object, so how far it reaches depends on the other code present on the site.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Site Reviews (WordPress plugin)to a version that resolves this vulnerability.Fixed in 8.3.0 - Compensating control
Ensure the Site Reviews plugin is not reachable by unauthenticated users until upgraded (e.g., restrict access to any exposed form endpoints related to the plugin via web server/WAF/ACL).
Event History
Frequently Asked Questions
Which installations are exposed to unauthenticated exploitation?
Affected installations are those running Site Reviews before 8.3.0 where the WordPress nonce key is absent, retains its sample value, or is too short to function as a secret. Under those conditions, the plugin's form-signature key can be publicly computed.
Does successful object injection automatically result in code execution?
No. The plugin's own code does not include a chain beyond the injected object; the practical impact depends on other PHP code and object chains present on the site.
What version addresses the deserialization issue?
Site Reviews 8.3.0 addresses the issue. Installations running versions before 8.3.0 should also ensure the WordPress nonce key is present, non-default, and sufficiently secret.