CVE-2026-94274 YayReviews 1.0.4 - 1.4.0 - Unauthenticated Sensitive Data Disclosure via REST API
Unauthenticated attackers can access sensitive customer review data, including email addresses, via an unrestricted REST API route in the YayReviews plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-94274?
CVE-2026-94274 is a medium-severity vulnerability in Unknown YayReviews, published on 30 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer review records, including reviews still pending moderation, allowing unauthenticated attackers to harvest reviewers' email addresses and other non-public review content.
Weakness: CWE-200
Which versions are affected by CVE-2026-94274?
How do I fix CVE-2026-94274?
No fix has been published for CVE-2026-94274 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-94274 being exploited?
There is no known exploitation of CVE-2026-94274 in the wild and no public exploit code.
Sources
Also known as GHSA-59gj-2qfc-4w2p.