The ReviewX WordPress plugin for WooCommerce product reviews contains an insecure storage vulnerability (CWE-922) that exposes sensitive user data through the syncedData function. This exposure allows unauthenticated remote attackers to retrieve personal information including user names, emails, phone numbers, and addresses. The issue affects all plugin versions up to 2.2.12. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No patch or vendor advisory is currently available to confirm remediation status.

The vulnerability leads to sensitive information exposure, compromising user privacy by allowing unauthorized access to personal data such as names, emails, phone numbers, and addresses. There is no impact on data integrity or system availability. Exploitation could facilitate further attacks or privacy violations but no known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the plugin's data endpoints or disabling the plugin if feasible to prevent unauthorized data exposure.