EUVD-2026-125977

The A2Reviews WordPress plugin through 1.2.3 does not properly verify authorization on several of its API command handlers, relying on a signature keyed on a value that is empty by default on an unconnected install, allowing unauthenticated attackers to modify A2Reviews WordPress plugin through...

CVE-2026-116559

The A2Reviews WordPress plugin (version 1.2.3 and below ) is vulnerable to unauthenticated plugin data modification and disclosure . The flaw exists because several API command handlers do not properly verify authorization; instead, they rely on a signature keyed on a value that is empty by defau...