CVE-2026-82925: CWE-502 Deserialization of Untrusted Data in Site Reviews
The Site Reviews WordPress plugin before version 8.3.0 contains a deserialization vulnerability that allows unauthenticated users to inject arbitrary PHP objects. This occurs because the plugin does not properly prevent request data from being deserialized and uses a key derived from the site's WordPress nonce key, which can be publicly computed if the nonce key is absent, default, or too short. The vulnerability's impact depends on other code present on the site, as the plugin itself does not provide a direct exploitation chain.
AI Analysis
Technical Summary
CVE-2026-82925 is a deserialization of untrusted data vulnerability (CWE-502) in the Site Reviews WordPress plugin versions before 8.3.0. The plugin improperly allows deserialization of request data using a key derived from the WordPress nonce key, which can be predictable or publicly computable on some installs. This flaw enables unauthenticated attackers to inject arbitrary PHP objects. The plugin's own code does not directly exploit the injected objects, so the actual impact depends on other plugins or code on the site that may interact with these objects.
Potential Impact
Unauthenticated attackers can inject arbitrary PHP objects via deserialization, potentially leading to remote code execution or other impacts depending on the presence of other vulnerable code on the site. The plugin itself does not provide a direct exploitation path, so the severity of impact varies with the site's environment and additional installed code.
Mitigation Recommendations
No official patch or remediation guidance is currently available. Users should upgrade to version 8.3.0 or later once released. Until then, sites should ensure their WordPress nonce key is properly set to a strong, secret value to reduce the risk of key predictability. Monitor the vendor advisory for updates and apply official fixes when available.
CVE-2026-82925: CWE-502 Deserialization of Untrusted Data in Site Reviews
Description
The Site Reviews WordPress plugin before version 8.3.0 contains a deserialization vulnerability that allows unauthenticated users to inject arbitrary PHP objects. This occurs because the plugin does not properly prevent request data from being deserialized and uses a key derived from the site's WordPress nonce key, which can be publicly computed if the nonce key is absent, default, or too short. The vulnerability's impact depends on other code present on the site, as the plugin itself does not provide a direct exploitation chain.
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-82925 is a deserialization of untrusted data vulnerability (CWE-502) in the Site Reviews WordPress plugin versions before 8.3.0. The plugin improperly allows deserialization of request data using a key derived from the WordPress nonce key, which can be predictable or publicly computable on some installs. This flaw enables unauthenticated attackers to inject arbitrary PHP objects. The plugin's own code does not directly exploit the injected objects, so the actual impact depends on other plugins or code on the site that may interact with these objects.
Potential Impact
Unauthenticated attackers can inject arbitrary PHP objects via deserialization, potentially leading to remote code execution or other impacts depending on the presence of other vulnerable code on the site. The plugin itself does not provide a direct exploitation path, so the severity of impact varies with the site's environment and additional installed code.
Mitigation Recommendations
No official patch or remediation guidance is currently available. Users should upgrade to version 8.3.0 or later once released. Until then, sites should ensure their WordPress nonce key is properly set to a strong, secret value to reduce the risk of key predictability. Monitor the vendor advisory for updates and apply official fixes when available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-08-31T11:50:40.276Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6aa25045acd9273b49ac4be5
Added to database: 09/10/2026, 06:37:57 UTC
Last enriched: 09/10/2026, 06:53:00 UTC
Last updated: 09/10/2026, 06:53:00 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.