What is GHSA-59gj-2qfc-4w2p?

GHSA-59gj-2qfc-4w2p is a security advisory published by GitHub Security Advisories with Medium severity. The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that...

Which CVE IDs does GHSA-59gj-2qfc-4w2p cover?

GHSA-59gj-2qfc-4w2p covers the following CVE IDs: CVE-2026-94274. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-59gj-2qfc-4w2p?

GHSA-59gj-2qfc-4w2p has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-59gj-2qfc-4w2pMediumCVSS 5.3

The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that...

Vendor

GitHub Security Advisories

Published

September 30, 2026

Last Modified

September 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-94274 →

📋 Description

The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer review records, including reviews still pending moderation, allowing unauthenticated attackers to harvest reviewers' email addresses and other non-public review content.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-94274
https://wpscan.com/vulnerability/23965307-678d-4f59-beae-5a8b33af9a75
https://github.com/advisories/GHSA-59gj-2qfc-4w2p