{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-94274", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-09-21T09:21:44.365Z", "datePublished": "2026-09-30T06:00:25.663Z", "dateUpdated": "2026-09-30T06:00:25.663Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-09-30T06:00:25.663Z"}, "title": "YayReviews 1.0.4 - 1.4.0 - Unauthenticated Sensitive Data Disclosure via REST API", "problemTypes": [{"descriptions": [{"description": "CWE-200 Information Exposure", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "YayReviews", "versions": [{"status": "affected", "versionType": "semver", "version": "1.0.4", "lessThan": "1.4.1"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer review records, including reviews still pending moderation, allowing unauthenticated attackers to harvest reviewers' email addresses and other non-public review content."}], "references": [{"url": "https://wpscan.com/vulnerability/23965307-678d-4f59-beae-5a8b33af9a75/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Pablo Gonz\u00e1lez P\u00e9rez", "type": "finder"}, {"lang": "en", "value": "Francisco Jos\u00e9 Ram\u00edrez Vicente", "type": "finder"}, {"lang": "en", "value": "and I\u00f1igo S\u00e1nchez Enciso", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "YayReviews", "vendor": "Unknown", "versions": [{"lessThan": "1.4.1", "status": "affected", "version": "1.0.4", "versionType": "semver"}]}], "source": "[email protected]"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer review records, including reviews still pending moderation, allowing unauthenticated attackers to harvest reviewers' email addresses and other non-public review content."}], "id": "CVE-2026-94274", "lastModified": "2026-09-30T06:17:10.367", "metrics": {}, "published": "2026-09-30T06:17:10.367", "references": [{"source": "[email protected]", "url": "https://wpscan.com/vulnerability/23965307-678d-4f59-beae-5a8b33af9a75/"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Received"}

{}

{}