YayReviews 1.0.4 - 1.4.0 - Unauthenticated Sensitive Data Disclosure via REST API

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Unknown/YayReviews (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Unknown/YayReviews.
2. 2Review the reported fix. Update Unknown/YayReviews to 1.4.1 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Sep 30, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Sep 30, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Sep 30, 2026

Sources and claim methodology

• Source referencewpscan.com

Related CVEs

• Solace Extra < 1.7.2 - Unauthenticated Non-Published Post Content Disclosure via Preview RoutesAlso CWE-200
• New User Approve 3.1.0 - 3.2.9 - Unauthenticated PII Disclosure via Zapier API Key BypassAlso CWE-200
• Connections Business Directory <= 10.4.67 - Unauthenticated Non-Public Directory Entry Disclosure via cn-api/v1 REST RoutesAlso CWE-200
• Image Optimizer by Elementor < 1.7.7 - Subscriber+ Attachment Metadata and Site Statistics Disclosure via Discarded REST Permission CallbacksAlso CWE-200
• Course Booking System < 7.0.9 - Unauthenticated Attendee PII Disclosure via CSV ExportAlso CWE-200
• FluentCart < 1.6.5 - Unauthenticated Guest Customer Account Takeover via Checkout EmailSame generic ecosystem