What is the CVSS score of CVE-2025-10679?

CVE-2025-10679 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2025-10679?

WordPress sites running the ReviewX plugin (versions ≤2.2.12) face a critical remote code execution risk from unauthenticated attackers.

How to fix or mitigate CVE-2025-10679?

Within 24 hours: Audit all WordPress instances for ReviewX plugin presence and version; disable the plugin immediately if found and update to version 2.2.13 or later when available. Within 7 days: Implement WAF rules blocking POST requests to vulnerable endpoints (/wp-admin/admin-ajax.php with action=reviewx_*) and conduct forensic logs review for exploitation attempts. Within 30 days: Establish a plugin inventory and patch management process; evaluate alternative review plugins with active security maintenance if ReviewX updates remain unavailable.

PHP CVE-2025-10679

EUVD-2025-208924 HIGH

Code Injection (CWE-94)

2026-03-23 Wordfence

GHSA-7q98-jvc7-4p5q

WordPress PHP RCE Information Disclosure Code Injection Google

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 23, 2026 - 05:45 euvd

EUVD-2025-208924

Analysis Generated

Mar 23, 2026 - 05:45 vuln.today

CVE Published

Mar 23, 2026 - 05:29 nvd

HIGH 7.3

DescriptionCVE.org

The ReviewX - WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to arbitrary method calls in all versions up to, and including, 2.2.12. This is due to insufficient input validation in the bulkTenReviews function that allows user-controlled data to be passed directly to a variable function call mechanism. This makes it possible for unauthenticated attackers to call arbitrary PHP class methods that take no inputs or have default values, potentially leading to information disclosure or remote code execution depending on available methods and server configuration.

AnalysisAI

The ReviewX plugin for WordPress contains a critical arbitrary method call vulnerability in all versions up to and including 2.2.12. Unauthenticated attackers can exploit insufficient input validation in the bulkTenReviews function to call arbitrary PHP class methods, potentially achieving remote code execution or information disclosure. With a CVSS score of 7.3 and network-based exploitation requiring no privileges or user interaction, this presents a significant risk to WordPress sites using this WooCommerce product review plugin.

Technical ContextAI

This vulnerability affects the ReviewX – WooCommerce Product Reviews plugin (CPE: cpe:2.3:a:reviewx:reviewx_–_multi-criteria_reviews_for_woocommerce_with_google_reviews_&_schema:*:*:*:*:*:*:*:*), a WordPress plugin for managing product reviews with multi-criteria ratings and Google Reviews integration. The root cause is CWE-94 (Improper Control of Generation of Code or 'Code Injection'), specifically manifesting as user-controlled data being passed to variable function calls without proper validation. The bulkTenReviews function in the ReviewController accepts external input that directly controls which PHP class methods are invoked, creating a dangerous method chaining opportunity. References to the source code show the vulnerable code path through routes/api.php, ReviewController.php, ReviewService.php, and Helper.php in version 2.2.7, demonstrating how unsanitized input flows through multiple layers to reach the variable function call mechanism.

RemediationAI

Immediately update the ReviewX plugin to a version newer than 2.2.12 that addresses this vulnerability. Consult the Wordfence threat intelligence page at https://www.wordfence.com/threat-intel/vulnerabilities/id/0935ede4-05bc-48a2-94a3-8d92002e02bb?source=cve for the latest patched version information. Until patching is completed, consider temporarily disabling the ReviewX plugin if not essential for business operations, or implement web application firewall (WAF) rules to block requests to the vulnerable bulkTenReviews endpoint. Organizations should review web server logs for suspicious API requests to routes/api.php endpoints that may indicate exploitation attempts, particularly POST requests with unusual method parameters targeting the ReviewController functionality.