PT-2026-49651 · Https://Wpreviewslider.Com/ · Wp Review Slider Pro

Published 2026-06-16 · Updated 2026-06-16 · CVE-2026-8442

NVD

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

The WP Review Slider Pro plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 12.6.8. This is due to missing authorization checks on the wpfb hide review and wprp save review admin AJAX handlers combined with insufficient path validation in the wpfb hidereview ajax() function, which uses strpos() to check that a stored media URL starts with the expected prefix but fails to sanitize path traversal sequences in the remaining relative path before passing it to unlink(). This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the affected site's server which may make remote code execution possible.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-8442

Affected Products

Wp Review Slider Pro

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-8442 · Security Note
• https://wpreviewslider.com · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/f3af6f70-aa7e-4f33-88c0-45befaab2b29?source=cve · Note