CVE-2026-109323 in Star Ratings Plugin
Summary
by MITRE • 10/12/2026
Grav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerability that allows unauthenticated visitors to vote by bypassing client-only vote_access and readonly enforcement. Attackers can use the anonymous nonce emitted by getData() to submit votes directly to addVote(), manipulating restricted or disabled ratings and aggregate rating output.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The Grav Star Ratings plugin, specifically versions 2.0.1 through 2.0.3, suffers from a critical missing authorization vulnerability that undermines the integrity of user-generated content by allowing unauthenticated actors to manipulate voting outcomes. This flaw stems from an inadequate server-side validation mechanism where access control logic is enforced exclusively at the client level rather than being rigorously validated on the backend during request processing. The plugin relies heavily on JavaScript-based checks, such as vote_access and readonly state enforcement, to determine whether a user interface element should permit interaction or submission of data. While these frontend measures effectively prevent casual users from clicking voting buttons in standard browsing scenarios, they offer no protection against automated tools or malicious scripts that can bypass the graphical interface entirely by sending direct HTTP requests to the underlying API endpoints.
The technical core of this vulnerability lies in the improper handling of authentication tokens and state management within the plugin's architecture. The getData() function emits an anonymous nonce intended for use in subsequent interactions, which serves as a temporary credential or session identifier. An attacker can exploit this by capturing the response from getData(), extracting the emitted nonce, and then immediately submitting it to the addVote() endpoint without any prior authentication or valid user session. Because the server-side implementation of addVote() does not verify whether the requester possesses legitimate administrative privileges or even a verified identity before processing the vote submission, the system accepts these unauthorized requests as valid actions. This design oversight effectively neutralizes the intended security controls, allowing external parties to inject votes into ratings that are explicitly configured as restricted or disabled by site administrators.
The operational impact of this vulnerability is significant for any website relying on Grav Star Ratings for feedback aggregation, reputation management, or user engagement metrics. Attackers can artificially inflate or deflate rating scores through automated voting scripts, leading to distorted aggregate data that misrepresents the true quality or popularity of content. This manipulation not only compromises the trustworthiness of the platform but also poses a risk to business logic if ratings influence search rankings, product recommendations, or user decisions based on perceived community consensus. Furthermore, because the vulnerability allows for unauthenticated access, it can be exploited at scale with minimal effort, potentially leading to resource exhaustion through rapid-fire vote submissions if rate limiting is not independently implemented elsewhere in the application stack.
To mitigate this risk, immediate remediation involves upgrading the Grav Star Ratings plugin to a version that addresses these authorization gaps by implementing robust server-side validation for all voting operations. Developers must ensure that access control checks are performed on every state-changing request, verifying both user authentication status and specific permissions before processing vote submissions. Additionally, relying solely on client-side restrictions is insufficient; security controls must be enforced at the application layer to prevent direct API manipulation. Implementing rate limiting mechanisms can also help mitigate abuse by detecting and blocking anomalous voting patterns from single IP addresses or sessions. Until an official patch is applied, administrators should consider disabling the plugin entirely if its functionality is not critical, thereby eliminating the attack surface associated with this vulnerability.