PT-2026-27047 · WordPress+1 · Reviewx+1

Abrahack · Published 2026-03-23 · Updated 2026-03-23 · CVE-2025-10679

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress versions through 2.2.12

Description The ReviewX plugin for WordPress is susceptible to arbitrary method calls due to inadequate input validation within the bulkTenReviews function. This allows attackers to pass user-controlled data to a variable function call, potentially enabling the execution of arbitrary PHP class methods that require no inputs or have default values. Successful exploitation could lead to information disclosure or remote code execution, contingent upon the server configuration and available methods.

Recommendations Update the ReviewX plugin to a version newer than 2.2.12.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-10679

Affected Products

Reviewx

Woocommerce

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-10679 · Security Note
• https://plugins.trac.wordpress.org/browser/reviewx/tags/2.2.7/routes/api.php#L220 · Note
• https://twitter.com/CVEarity/status/2036123928528351467 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/0935ede4-05bc-48a2-94a3-8d92002e02bb?source=cve · Note
• https://twitter.com/CVEnew/status/2035992471910457391 · Twitter Post
• https://plugins.trac.wordpress.org/browser/reviewx/tags/2.2.7/app/Utilities/Helper.php#L65 · Note
• https://plugins.trac.wordpress.org/browser/reviewx/tags/2.2.7/app/Rest/Controllers/ReviewController.php#L426 · Note
• https://plugins.trac.wordpress.org/browser/reviewx/tags/2.2.7/app/Services/ReviewService.php#L731 · Note