Missing authorization in videowhisper Rate Star Review Vote – AJAX Reviews, Votes, Star…
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
The Rate Star Review Vote - AJAX Reviews, Votes, Star Ratings plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.6.4. The vwrsr_review() AJAX handler lacks both capability checks and nonce verification. The only access control is an is_user_logged_in() check. When the 'form' parameter is set to 'update', the function takes an arbitrary post ID from the user-supplied 'rating_id' GET parameter, sets it as the post ID in the update array, and passes it directly to wp_update_post(). This overwrites the target post's title, content, author (changed to the attacker's user ID), post_type (changed to the plugin's custom post type, default 'review'), and status. Additionally, update_post_meta() is called on the arbitrary post ID at lines 758-763, modifying its metadata. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the title, content, author, post type, and metadata of arbitrary posts and pages on the site via the 'rating_id' parameter, effectively allowing full post content takeover.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| videowhisper | Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings | up to 1.6.4 | — | No fix listed | CNA |
- Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings Vendorvideowhisper Affected up to 1.6.4 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-4301
- 2026-10-03 Alias added: GHSA-vpjj-cp57-c66r
References
Other 7
- https://www.wordfence.com/threat-intel/vulnerabilities/id/107cb15f-4b2e-4ed4-8e8a-4f716f4873db?source=cve
- https://plugins.trac.wordpress.org/browser/rate-star-review/trunk/rate-star-review.php#L754
- https://plugins.trac.wordpress.org/browser/rate-star-review/tags/1.6.4/rate-star-review.php#L754
- https://plugins.trac.wordpress.org/browser/rate-star-review/trunk/rate-star-review.php#L730
- https://plugins.trac.wordpress.org/browser/rate-star-review/tags/1.6.4/rate-star-review.php#L730
- https://plugins.trac.wordpress.org/browser/rate-star-review/trunk/rate-star-review.php#L758
- https://plugins.trac.wordpress.org/browser/rate-star-review/tags/1.6.4/rate-star-review.php#L758
More videowhisper vulnerabilities
- TI-2014-01486 Unrestricted file upload vulnerability in ls/vw_snapshots.php in the VideoWhisper Live… CVSS 2.0HIGH 10.0
- TI-2025-22561 WordPress Paid Videochat Turnkey Site plugin <= 7.3.11 - Broken Authentication Vulnerability CVSS 3.1CRITICAL 9.8
- TI-2015-07650 The videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers… CVSS 3.0CRITICAL 9.8
- TI-2015-07649 The VideoWhisper videowhisper-video-conference-integration plugin 4.91.8 for WordPress… CVSS 3.0CRITICAL 9.8
- TI-2023-10975 WordPress VideoWhisper Live Streaming Integration plugin <= 5.5.15 - Remote Code Execution (RCE) CVSS 3.1CRITICAL 9.8
- TI-2026-41268 WordPress Paid Videochat Turnkey Site plugin <= 7.4.8 - Arbitrary File Deletion vulnerability CVSS 3.1CRITICAL 9.9
Sources
- CVE-2026-4301 · CVE Program
- CVE-2026-4301 · NVD
- FIRST EPSS
- GHSA-vpjj-cp57-c66r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences