PT-2025-20619 · WordPress · The Wordpress Review Plugin
Hiroho Shimada
·
Publicado
2025-05-10
·
Atualizado
2025-06-13
·
CVE-2025-2158
CVSS v3.1
8.8
Alta
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
The WordPress Review Plugin: The Ultimate Solution for Building a Review Website versions up to, and including, 5.3.5
Description
The WordPress Review Plugin is vulnerable to Local File Inclusion, allowing authenticated attackers with Contributor-level access and above to include and execute arbitrary files on the server. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP file types can be uploaded and included, or pearcmd is enabled on a server with register argc argv also enabled.
Recommendations
For versions up to, and including, 5.3.5, update to a version that fixes the Local File Inclusion issue to prevent authenticated attackers from including and executing arbitrary files on the server. As a temporary workaround, consider restricting access to Post custom fields to minimize the risk of exploitation.
Correção
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
The Wordpress Review Plugin