CVE-2023-2833: reviewx reviewx – multi-criteria reviews for woocommerce with google reviews & schema Improper Privilege Management

Vulnerability summary

CVE-2023-2833 is a high (CVSS 8.8) Improper Privilege Management vulnerability in reviewx reviewx – multi-criteria reviews for woocommerce with google reviews & schema. EPSS estimates a 17.48% chance of exploitation in the next 30 days, higher than 97.1% of scored vulnerabilities. 3 public exploits are recorded. Fixed in 1.6.14.

Timeline

1. 06-06-2023
   PublishedVulnerability first disclosed.
2. 08-04-2026
   Last modifiedVulnerability information updated.

Description

The ReviewX plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.6.13 due to insufficient restriction on the 'rx_set_screen_options' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'wp_screen_options[option]' and 'wp_screen_options[value]' parameters during a screen option update.

• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.