CVE-2023-4642: The kk Star Ratings WordPress plugin before 5.4.6 does not implement atomic operations, allowing one user vote multiple times on a poll due to a Race Condition.

medium Affects kk-star-ratings (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2023-11-27; advisory modified 2026-06-17.

The kk Star Ratings WordPress plugin before 5.4.6 does not implement atomic operations, allowing one user vote multiple times on a poll due to a Race Condition.

Package: kk-star-ratings (WordPress plugin) WordPress
Affected versions: <5.4.6
Fixed in: 5.4.6
Severity: medium CVSS 5.9
Exploitation: not on CISA KEV · EPSS 0% (35.6th percentile)
Published: 2023-11-27
Source: nvd

References

CWE-362

NVD record kk-star-ratings (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2018-19370 medium A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in same weakness: CWE-362
CVE-2024-7627 high The Bit File Manager plugin for WordPress is vulnerable to Remote Code Execution in versio same weakness: CWE-362
CVE-2022-24800 high October CMS upload process vulnerable to RCE via Race Condition same weakness: CWE-362
CVE-2021-24377 high The Autoptimize WordPress plugin before 2.7.8 attempts to remove potential malicious files same weakness: CWE-362
CVE-2019-8232 medium Magento 2 Community Edition RCE Vulnerability same weakness: CWE-362
CVE-2022-0279 low The AnyComment WordPress plugin before 0.2.18 is affected by a race condition when liking/ same weakness: CWE-362