CVE-2023-37867 WordPress Yet Another Stars Rating Plugin <= 3.3.8 is vulnerable to Race Condition

Q: What is CVE-2023-37867?

CVE-2023-37867 is a low-severity vulnerability in YetAnotherStarsRating.com YASR – Yet Another Star Rating Plugin for WordPress, published on 30 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Q: Is CVE-2023-37867 being exploited?

There is no known exploitation of CVE-2023-37867 in the wild and no public exploit code.

Q: How do I fix CVE-2023-37867?

No fix has been published for CVE-2023-37867 yet. Limit exposure of the affected software until one is available.

Low 3.7 Published 30 Nov 2023 Updated 28 Apr 2026

Attackers can exploit a race condition in the YASR WordPress plugin to manipulate rating data, requiring plugin updates to mitigate.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-37867?

CVE-2023-37867 is a low-severity vulnerability in YetAnotherStarsRating.com YASR – Yet Another Star Rating Plugin for WordPress, published on 30 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in YetAnotherStarsRating.Com YASR – Yet Another Star Rating Plugin for WordPress.This issue affects YASR – Yet Another Star Rating Plugin for WordPress: from n/a through 3.3.8.

Weakness: CWE-367

Which versions are affected by CVE-2023-37867?

It affects 1 product.

Products include Yet Another Stars Rating Project Yet Another Stars Rating.

How do I fix CVE-2023-37867?

No fix has been published for CVE-2023-37867 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-37867 being exploited?

There is no known exploitation of CVE-2023-37867 in the wild and no public exploit code.

Sources

Also known as GHSA-fxxg-p5jg-fxmj.