Medium severity · published Mar 23, 2026
CVE-2025-10731
ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Sensitive Information Exposure to Data Export
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
The ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.12 via the allReminderSettings function. This makes it possible for unauthenticated attackers to obtain authentication tokens and subsequently bypass admin restrictions to access and export sensitive data including order details, names, emails, addresses, phone numbers, and user information.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RM
ReviewX – Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema · reviewx
through 2.2.12 · source: vendor
Affected product
RM
ReviewX – Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema
reviewx
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-10731
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-10731
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/reviewx/tags/2.2.7/app/Rest/Controllers/DataSyncController.php#L68
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/reviewx/tags/2.2.7/app/Rest/Controllers/EmailTemplateController.php#L165
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/reviewx/tags/2.2.7/app/Rest/Middleware/AdminMiddleware.php#L11
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/06b290c2-e458-46da-abed-0ab5d63d1550?source=cve
More from ReviewX – Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema
8.8
CVE-2023-2833
ReviewX <= 1.6.13 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation
7.3
CVE-2025-10679
ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Limited Remote Code Execution
6.5
CVE-2025-10736
ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.10 - Incorrect Authorization to Unauthenticated Information Exposure and Data Manipulation
5.3
CVE-2025-10734
ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Sensitive Information Exposure
4.3
CVE-2024-3609
ReviewX – Multi-criteria Rating & Reviews for WooCommerce <= 1.6.27 - Missing Authorization