can give review in Products without star rating (0 star)

[kokonaing]

Steps To Reproduce:

In WordPress site ​https://wordpress.org, there are a lot themes uploaded
by each vendor. And there is a rating and review form in each theme. In
this phrase, the attacker can give review without stars rating although
WordPress enforces to give at least one star.

When the reviewed form is submitted with any stars, the attacker will

intercept the request and can delete rating parameter &rating=5&rating=5.

After deleting this parameter from request and the attacker can

successful rate the products with 0 star. 3.All wordpress site should be
worked.

[kokonaing]

Here is successful 0 star rating and should be worked in all Wordpress Versions.

[Otto42]

Duplicate of #5291.

[Hareesh Pillai]

This was earlier fixed in #5291 for Support Forum rating submissions.
Is it different for Themes?

[Otto42]

Nope. Same code, already fixed. The image he posted is old.

[Hareesh Pillai]

Thank you for the clarification.

@kokonaing Please reopen this ticket if you are still able to reproduce this at your end.