CVE-2026-109323

Grav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerability that allows unauthenticated visitors to vote by bypassing client-only voteaccess and readonly enforcement. Attackers can use the anonymous nonce emitted by getData to submit votes directly to addVote, manipulatin...

CVE-2026-109323 Grav Star Ratings 2.0.1 through 2.0.3 Missing Server-Side vote_access Authorization

Grav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerability that allows unauthenticated visitors to vote by bypassing client-only voteaccess and readonly enforcement. Attackers can use the anonymous nonce emitted by getData to submit votes directly to addVote, manipulatin...

CVE-2026-109323

The Grav Star Ratings plugin (versions 2.0.1 through 2.0.3 ) contains a missing server-side authorization vulnerability (CWE-862). This flaw allows unauthenticated visitors to bypass client-side vote_access and readonly enforcement. By utilizing an anonymous nonce obtained from the getData() func...