CVE-2025-57997

Vulnerability

Overview The Trustpilot Reviews plugin for WordPress versions up to and including 2.5.925 suffers from a missing authorization vulnerability [1]. This broken access control issue means that certain functions or endpoints do not properly verify user permissions, allowing unprivileged users to perform actions that should require higher privileges.

Exploitation

An attacker can exploit this vulnerability without authentication, as the missing authorization check does not require a valid nonce or capability verification [1]. This makes it possible for unauthenticated visitors to trigger privileged actions, such as modifying plugin settings or accessing sensitive data. The vulnerability is known to be used in mass-exploit campaigns targeting thousands of websites simultaneously [1].

Impact and

Mitigation Successful exploitation could lead to unauthorized changes to the plugin's configuration or data exposure, depending on the specific missing authorization. The CVSS score of 4.3 indicates a medium severity. The vendor has released version 3.6.0 which patches the issue; users are strongly advised to update immediately [1]. If updating is not possible, consulting a hosting provider or web developer is recommended [1].