Plugin Name: WP Customer Reviews
- Software Type: Plugin
- Software Slug: wp-customer-reviews
- Software Status: Active
- Software Author: bompus
- Software Downloads: 1,108,443
- Active Installs: 30,000
- Last Updated: October 31, 2023
- Patched Versions: No Patched Version
- Affected Versions: <= 3.6.8
- Name: WP Customer Reviews <= 3.6.8 - Authenticated (Subscriber+) Sensitive Information Exposure
- Title: Authenticated (Subscriber+) Sensitive Information Exposure
- Type: Missing Authorization
- CVE: CVE-2023-4686
- CVSS Score: 4.3 (Medium)
- Publicly Published: October 31, 2023
- Researcher: Marco Wotschka
- Description: The WP Customer Reviews plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.6.8 via the ajax_enabled_posts function. This can allow authenticated attackers to extract sensitive data such as post titles and slugs, including those of protected and trashed posts and pages in addition to other post types such as galleries.
The WP Customer Reviews plugin for WordPress has a vulnerability in versions up to and including 3.6.8 that allows authenticated users to access sensitive information via the ajax_enabled_posts function. This vulnerability has not yet been patched.
Researcher Marco Wotschka discovered a missing authorization vulnerability in the WP Customer Reviews plugin that affects versions up to and including 3.6.8. The ajax_enabled_posts function allows authenticated users, including those with just subscriber access, to extract sensitive information such as post titles, slugs, and details about protected, trashed, or unpublished posts. This exposes private data that could be leveraged for further attacks. The vulnerability has a CVSS score of 4.3 (Medium severity). At the time of publishing, no patch is available from the plugin developers to address this issue.
Advice for Users:
- Immediate Action: There is no patched version available at this time. Users should consider deactivating or uninstalling WP Customer Reviews until an update is released.
- Check for Signs of Compromise: Review your WordPress content and logs for any unauthorized changes or access.
- Alternate Plugins: Consider alternative customer review plugins like Yotpo, WP Reviews, or Google Reviews Widget until this vulnerability is resolved.
- Stay Updated: Monitor the WP Customer Reviews changelog for new releases and update as soon as a fixed version is published.
This vulnerability in a widely used WordPress plugin underscores the importance of keeping software updated. WP Customer Reviews users should take steps to secure their sites until an official patch is released.
Keeping your WordPress website secure requires constant vigilance - from using strong passwords to limiting plugins. Unfortunately, even if you do everything right, vulnerabilities in popular plugins can put your site at risk.
That’s why it’s critical to stay on top of plugin updates and news about newly disclosed flaws. Case in point: a serious vulnerability was recently revealed in WP Customer Reviews that impacts over 30,000 WordPress users.
In this post, we’ll break down this vulnerability, its risks, and most importantly, what you can do to lock down your site. Even if you don’t use this specific plugin, it highlights the need for proper WordPress hygiene.
We’ll also offer recommendations for alternate review plugins and resources to improve your overall website security. Don’t let plugins be your weak spot - arm yourself with knowledge. Let’s dive in and make sure your site stays safe.
What is WP Customer Reviews?
WP Customer Reviews is a popular WordPress plugin with over 1 million downloads. It allows site owners to easily add and manage customer reviews on their website. The plugin is actively maintained and updated.
Researcher Marco Wotschka recently discovered a vulnerability in WP Customer Reviews affecting versions up to and including 3.6.8.
The vulnerability allows authenticated users, including subscribers, to access sensitive information via the ajax_enabled_posts function. This includes post titles, slugs, and details of unpublished or protected content.
The flaw enables privilege escalation and information disclosure. Attackers could leverage exposed private data to further compromise sites. It has a CVSS severity score of 4.3 (Medium).
Risks and Potential Impact
This vulnerability puts over 30,000 WordPress sites at risk. Beyond exposing non-public information, the flaw could enable comment spam, phishing, or further attacks through extracted details.
Hackers with basic subscriber access could scrape sensitive data and customer emails, damage SEO, spread malware, and more. Even without patches, some attacks via this method may be imminent.
Remediating the Vulnerability
Unfortunately at this time no official patch is available from the plugin developer. For optimal security, consider deactivating WP Customer Reviews until an update is released.
Alternate plugins like Yotpo, WP Reviews, and Google Reviews Widget can serve as temporary substitutes. Be sure to monitor the WP Customer Reviews changelog for new releases.
This is one of 5 vulnerabilities identified in WP Customer Reviews since April 2014. The recurrent security issues point to systemic weaknesses in the plugin’s authorization and data handling.
The Importance of Staying Updated
For small business owners on WordPress, the lesson is clear: you must keep plugins updated. This single vulnerability impacts 30,000 sites - imagine the damage from hundreds of flawed plugins.
Sign up for plugin update notifications, test patches quickly, and consider limiting plugins to the essentials. Your livelihood depends on a secure website.
Security vulnerabilities like this one demonstrate the importance of having WordPress experts regularly monitor, maintain and update your site. At Your WP Guy, we offer ongoing management to handle updates, security monitoring, backups, uptime and support so you can stop worrying and get back to growing your business.
Let us fully audit your site to check for any signs of this vulnerability or other issues. We'll immediately update any out-of-date plugins and harden your site's security. Chat with us anytime during business hours, schedule a call or call 678-995-5169 to lock down your online presence.