---
id: CVE-2026-82925
title: >-
  The Site Reviews WordPress plugin before 8.3.0 does not prevent request data
  from being deserialized, and derives the key protecting that data by padding
  out the site's WordPress nonce key, which makes the key publicly computable on
  inst…
summary: >-
  The Site Reviews WordPress plugin before 8.3.0 does not prevent request data
  from being deserialized, and derives the key protecting that data by padding
  out the site's WordPress nonce key, which makes the key publicly computable on
  inst…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-502
product: Site Reviews
affected:
  - site_reviews >= 7.2.2 < 8.3.0
published: '2026-09-10'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T15:13:07.090'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-82925'
references:
  - url: 'https://wpscan.com/vulnerability/bce47707-b60c-42a7-8817-89b1483f41a3/'
    label: contact@wpscan.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-10T13:10:13.419353Z'
ingestedAt: '2026-09-10T06:34:51.924Z'
epss: 0.00453
epssPercentile: 0.36726
---

## Overview

The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or too short to be secret. This allows unauthenticated users to inject arbitrary PHP objects on such installs. The Site Reviews WordPress plugin before 8.3.0's own code contains no chain onward from the injected object, so how far it reaches depends on the other code present on the site.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.