CVE-2025-10731 is an improper authorization vulnerability in the ReviewX – WooCommerce Product Reviews plugin for WordPress, affecting all versions up to 2.2.12. The vulnerability resides in the allReminderSettings function, which can be accessed by unauthenticated users to retrieve authentication tokens. This unauthorized access enables attackers to bypass administrative controls and export sensitive customer and order information. The issue is categorized under CWE-285 (Improper Authorization) and has a CVSS 3.1 base score of 5.3 (medium severity), with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

An unauthenticated attacker can exploit this vulnerability to obtain authentication tokens and bypass admin restrictions. This leads to unauthorized access and export of sensitive data including order details, customer names, emails, addresses, phone numbers, and other user information. The confidentiality of customer and order data is compromised, but there is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin or disable it if possible. Monitor for updates from the vendor or security researchers and apply patches promptly once available.