CVE-2023-40332 is a medium severity (CVSS 5.3) flaw in the WP-PostRatings WordPress plugin, up to and including version 1.91. Visitors can get around the limit on how often they rate. Patchstack lists 1.91.1 as the patched version, so update the plugin.
What's affected
The record names the WordPress plugin WP-PostRatings, versions up to and including 1.91. It scores the flaw 5.3 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
The record lists two weaknesses: CWE-799 (improper control of interaction frequency) and CWE-290 (authentication bypass by spoofing). The NVD wording is that an attacker can misuse the functionality. Patchstack calls it a rating limit bypass. The vector needs no privileges and no user action, and the effect is a low impact on integrity.
Patchstack vulnerability database entry lists 1.91.1 as the patched version and rates its own priority as low. The record is dated 2024-06-04, while Patchstack's entry is dated 16 August 2023, so the fix has been available for a long time.
How to check if you're exposed
If you have shell access to the site, WP-CLI will show the installed version and whether an update is waiting:
wp plugin list --fields=name,status,version,update
wp plugin get wp-postratings --fields=name,version,update_version
Without WP-CLI, open Plugins in the WordPress admin and read the version under the plugin name. Anything at or below 1.91 is affected. Multisite owners should check each site and the network, because a plugin can be active on only some of them.
If you run many sites, collect the plugin list from each one and look for this plugin by its folder name, wp-postratings. You can also paste a manifest into the free in-browser dependency scan at gold.safeguard.sh/scan to see which known CVEs touch your packages.
What to do now
- Find every site that has WP-PostRatings installed, active or not. A deactivated plugin still sits on disk.
- Update to 1.91.1 or later from the Plugins screen, or with
wp plugin update wp-postratings. - If the plugin is no longer used, delete it rather than leaving it deactivated.
- Check which user roles can sign in to the site, and remove accounts that no longer need access.
- Turn on automatic updates for plugins you rely on, and keep a short list of what is installed on each site.
Why it matters
This is a nuisance class of bug more than a break in. WP-PostRatings lets a site collect star ratings from visitors, and the plugin limits how often one visitor can vote. A bypass means the limit can be skipped, so scores can be skewed by repeated submissions.
For a site that uses ratings in search results or to rank content, skewed scores are a business problem. For a site that shows them as decoration, the impact is small. Patchstack rates the priority as low, and the record sets confidentiality and availability impact to none.
The record does not describe the mechanism. A spoofing related weakness listed next to the frequency one suggests the limit relies on something a visitor can influence, but confirm that against the plugin changelog before you quote it.
Quick check
Can this bug take over my site?
Nothing in the record says so. The impact is limited to integrity, at a low level, and it concerns the rating feature.
How do I know my ratings were affected?
The record does not describe any log signal. Look for unusual spikes in votes on single posts, and compare them with your traffic.
Sources
Last reviewed: 19 October 2026.
