CVE-2023-2833: The ReviewX plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.6.13 due to insufficient restriction on the…

PriorityP267high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

17.48%

96.8th percentile

The ReviewX plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.6.13 due to insufficient restriction on the 'rx_set_screen_options' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'wp_screen_options[option]' and 'wp_screen_options[value]' parameters during a screen option update.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
reviewx	reviewx_multi-criteria_reviews_for_woocommerce_with_google_reviews_schema	<= 1.6.13	—
wpdeveloper	reviewx	<= 1.6.13	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.