The WordPress Review & Structure Data Schema Plugin (Review Schema) contains a missing authorization vulnerability (CWE-862) in the rtrs_review_edit() function. This function lacks proper capability checks, enabling authenticated users with subscriber-level privileges or higher to modify arbitrary review entries. The vulnerability affects all versions up to and including 2.1.14. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low attack complexity, requiring privileges, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact.

An attacker with subscriber-level access or higher can modify review data arbitrarily, potentially undermining the integrity of reviews displayed by the plugin. There is no impact on confidentiality or availability. This could affect trustworthiness of review content on affected WordPress sites but does not allow data disclosure or service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official patch, site administrators should consider restricting subscriber-level permissions or disabling the plugin until a fix is available. Monitor vendor channels for updates addressing this missing authorization vulnerability.