PT-2025-20619 · WordPress · The Wordpress Review Plugin

Hiroho Shimada

·

Published

2025-05-10

·

Updated

2025-06-13

·

CVE-2025-2158

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions The WordPress Review Plugin: The Ultimate Solution for Building a Review Website versions up to, and including, 5.3.5
Description The WordPress Review Plugin is vulnerable to Local File Inclusion, allowing authenticated attackers with Contributor-level access and above to include and execute arbitrary files on the server. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP file types can be uploaded and included, or pearcmd is enabled on a server with register argc argv also enabled.
Recommendations For versions up to, and including, 5.3.5, update to a version that fixes the Local File Inclusion issue to prevent authenticated attackers from including and executing arbitrary files on the server. As a temporary workaround, consider restricting access to Post custom fields to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-2158

Affected Products

The Wordpress Review Plugin