CVE-2026-94274 — YayReviews 1.0.4 - 1.4.0 - Unauthenticated Sensitive Data Disclosure via REST API
The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer review records, including reviews still pending moderatio…
Published: 2026-09-30 · CVSS: 5.3 · CVSS 3.1
The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer review records, including reviews still pending moderation, allowing unauthenticated attackers to harvest reviewers' email addresses and other non-public review content.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7