Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Starfish Review Generation & Marketing for WordPress plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'srm_restore_options_defaults' function in all versions up to, and including, 3.1.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-02-13 | 2 | Disclosure2 |
| 2026-02-17 | 1 | Disclosure1 |
CVE-2025-15157 The Starfish Review Generation & Marketing for WordPress plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation… https://www.cve.org/CVERecord?id=CVE-2025-15157
Post summary
CVE‑2025‑15157 exposes the Starfish Review Generation & Marketing WordPress plugin to unauthorized data modification, enabling privilege escalation.
[CVE-2025-15157: HIGH] WordPress plugin Starfish Review Generation & Marketing plugin is vulnerable to unauthorized data modification, posing a privilege escalation risk, impacting versions up to 3.1.19.#cve,CVE-2025-15157,#cybersecurity https://cvefind.com/CVE-2025-15157
Post summary
WordPress Starfish Review Generation & Marketing plugin up to version 3.1.19 is vulnerable to unauthorized data modification, enabling privilege escalation.
🟠 CVE-2025-15157 - High The Starfish Review Generation & Marketing for WordPress plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capabil... https://www.thehackerwire.com/vulnerability/CVE-2025-15157/ https://t.co/vACMjtjKOd
Post summary
The Starfish Review Generation & Marketing WordPress plugin is reported to have CVE-2025-15157, allowing unauthorized data modification that can result in privilege escalation; no PoC, exploit, or patch is mentioned.