EUVD-2025-208924
GHSA-7q98-jvc7-4p5q
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) indicates this is a remotely exploitable vulnerability with low attack complexity requiring no authentication or user interaction, making it highly accessible to attackers. The partial impact ratings across confidentiality, integrity, and availability reflect the conditional nature of exploitation - actual impact depends on which methods are available in the execution context and server configuration. While the 7.3 CVSS score suggests high severity, the real-world risk is elevated by the unauthenticated attack surface and the prevalence of WordPress/WooCommerce deployments. The availability of source code references showing the exact vulnerable code paths significantly lowers the barrier for exploit development. This vulnerability is automatable and could be incorporated into mass exploitation campaigns targeting WordPress sites, making it a genuine priority for organizations running the affected plugin versions despite the partial impact ratings. |
| Exploit ScenarioDerived | An unauthenticated attacker identifies a WordPress site running ReviewX version 2.2.12 or earlier and crafts a malicious HTTP request to the plugin's API endpoint targeting the bulkTenReviews function. By manipulating the method parameter, the attacker invokes arbitrary PHP class methods available in the application context, potentially calling destructive methods, accessing sensitive configuration data, or executing code if a suitable method chain exists. The attack requires no user interaction and can be automated to scan and exploit thousands of WordPress sites running the vulnerable plugin. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 23, 2026
The ReviewX plugin for WordPress contains a critical arbitrary method call vulnerability in all versions up to and including 2.2.12. Unauthenticated attackers can exploit insufficient input validation in the bulkTenReviews function to call arbitrary PHP class methods, potentially achieving remote code execution or information disclosure. With a CVSS score of 7.3 and network-based exploitation requiring no privileges or user interaction, this presents a significant risk to WordPress sites using this WooCommerce product review plugin.
RemediationAI
Immediately update the ReviewX plugin to a version newer than 2.2.12 that addresses this vulnerability. Consult the Wordfence threat intelligence page at https://www.wordfence.com/threat-intel/vulnerabilities/id/0935ede4-05bc-48a2-94a3-8d92002e02bb?source=cve for the latest patched version information. Until patching is completed, consider temporarily disabling the ReviewX plugin if not essential for business operations, or implement web application firewall (WAF) rules to block requests to the vulnerable bulkTenReviews endpoint. Organizations should review web server logs for suspicious API requests to routes/api.php endpoints that may indicate exploitation attempts, particularly POST requests with unusual method parameters targeting the ReviewController functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability affects the ReviewX – WooCommerce Product Reviews plugin (CPE: cpe:2.3:a:reviewx:reviewx_–_multi-criteria_reviews_for_woocommerce_with_google_reviews_&_schema:*:*:*:*:*:*:*:*), a WordPress plugin for managing product reviews with multi-criteria ratings and Google Reviews integration. The root cause is CWE-94 (Improper Control of Generation of Code or 'Code Injection'), specifically manifesting as user-controlled data being passed to variable function calls without proper validation. The bulkTenReviews function in the ReviewController accepts external input that directly controls which PHP class methods are invoked, creating a dangerous method chaining opportunity. References to the source code show the vulnerable code path through routes/api.php, ReviewController.php, ReviewService.php, and Helper.php in version 2.2.7, demonstrating how unsanitized input flows through multiple layers to reach the variable function call mechanism.
Know when Reviewx gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The ReviewX - WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to arbitrary method calls in all versions up to, and including, 2.2.12. This is due to insufficient input validation in the bulkTenReviews function that allows user-controlled data to be passed directly to a variable function call mechanism. This makes it possible for unauthenticated attackers to call arbitrary PHP class methods that take no inputs or have default values, potentially leading to information disclosure or remote code execution depending on available methods and server configuration.
Executive ViewAI
WordPress sites running the ReviewX plugin (versions ≤2.2.12) face a critical remote code execution risk from unauthenticated attackers. This vulnerability could allow unauthorized access to sensitive data, site compromise, or complete infrastructure takeover without requiring any user credentials or interaction.
Disable ReviewX plugin immediately; implement WAF rules to block requests to wp-admin/admin-ajax.php containing 'action=reviewx_bulkTenReviews' or similar ReviewX endpoints; restrict plugin access by IP whitelist if possible; monitor access logs for exploitation patterns; consider switching to actively maintained alternative review plugins; implement web application firewall (ModSecurity or similar) to validate input on affected endpoints; segregate affected WordPress instances from critical infrastructure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
The ReviewX plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.6.13 due to i
The 'rx_export_review' action in the ReviewX WordPress Plugin, is affected by an authenticated SQL injection vulnerabili
Missing Authorization vulnerability in ReviewX ReviewX allows Exploiting Incorrectly Configured Access Control Security
Authentication bypass in the ReviewX WordPress plugin versions 2.3.6 and earlier allows remote unauthenticated attackers
Reflected/stored Cross-Site Scripting in the ReviewX WordPress plugin (versions 2.3.10 and earlier) allows unauthenticat
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ReviewX allows Sto
The ReviewX plugin for WordPress contains an improper authorization vulnerability in the userAccessibility() function th
A vulnerability in ReviewX ReviewX reviewx.6.7. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploit
The ReviewX WordPress plugin for WooCommerce contains an unauthenticated sensitive information exposure vulnerability in
The ReviewX - WooCommerce Product Reviews plugin for WordPress contains a Sensitive Information Exposure vulnerability i
The ReviewX - Multi-criteria Rating & Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized deletio
Missing Authorization vulnerability in ReviewX ReviewX reviewx allows Exploiting Incorrectly Configured Access Control S
Exploit-DB