PT-2026-27047 · WordPress+1 · Reviewx+1

Abrahack · Publicado 2026-03-23 · Atualizado 2026-03-23 · CVE-2025-10679

Positive Technologies (AI Summary)

CVSS v3.1

7.3

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress versions through 2.2.12

Description The ReviewX plugin for WordPress is susceptible to arbitrary method calls due to inadequate input validation within the bulkTenReviews function. This allows attackers to pass user-controlled data to a variable function call, potentially enabling the execution of arbitrary PHP class methods that require no inputs or have default values. Successful exploitation could lead to information disclosure or remote code execution, contingent upon the server configuration and available methods.

Recommendations Update the ReviewX plugin to a version newer than 2.2.12.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2025-10679

Produtos afetados

Reviewx

Woocommerce

Referências · 8

• https://plugins.trac.wordpress.org/browser/reviewx/tags/2.2.7/routes/api.php#L220 · Nota
• https://twitter.com/CVEarity/status/2036123928528351467 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/0935ede4-05bc-48a2-94a3-8d92002e02bb?source=cve · Nota
• https://twitter.com/CVEnew/status/2035992471910457391 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/reviewx/tags/2.2.7/app/Utilities/Helper.php#L65 · Nota
• https://plugins.trac.wordpress.org/browser/reviewx/tags/2.2.7/app/Rest/Controllers/ReviewController.php#L426 · Nota
• https://plugins.trac.wordpress.org/browser/reviewx/tags/2.2.7/app/Services/ReviewService.php#L731 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-10679 · Nota de Segurança