The vulnerability CVE-2025-10736 affects the ReviewX plugin for WooCommerce, specifically due to improper authorization (CWE-285) in the userAccessibility() function. This weakness permits unauthenticated remote attackers to bypass access controls on REST API endpoints, enabling unauthorized data access and modification related to users and plugin settings. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity but not availability. No patch or vendor advisory is currently provided, and no known exploits in the wild have been reported.

An attacker without authentication can access and modify sensitive information via protected REST API endpoints in the affected plugin versions. This compromises confidentiality and integrity of user data and plugin configuration. There is no indication of availability impact. The vulnerability could lead to unauthorized data disclosure and unauthorized changes within the plugin environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the REST API endpoints if possible, and monitor for unusual activity related to the plugin. Avoid exposing the affected plugin on publicly accessible sites without additional access controls.