CVE-2026-82925

The Site Reviews WordPress plugin before 8.3.0 deserializes attacker-controlled request data, but the key protecting that data is derived by padding out the site's WordPress nonce key, making the key publicly computable on installs where that key is absent, left at its sample value, or too short to be secret. On such installs, an unauthenticated attacker can compute the key and inject arbitrary PHP objects into the application (CWE-502). The plugin's own code contains no onward chain (gadget chain) from the injected object, so the actual impact depends on which other plugins and themes are installed; with a suitable chain, impact can reach high confidentiality, integrity, and availability (CVSS 8.1). Any WordPress site running Site Reviews before 8.3.0 with a missing, default, or overly short nonce key is affected. No public proof-of-concept is known and the flaw is not listed in CISA KEV, so no in-the-wild exploitation is currently known.

What to do: Update Site Reviews to version 8.3.0 or later. As an interim measure, verify that wp-config.php defines unique, long security keys (in particular the nonce key) rather than leaving the sample value or an empty/short value, since that is the condition that makes installs exploitable. Note that impact beyond object injection depends on other installed code, so review plugins and themes for known PHP object-injection gadget chains.