EUVD-2025-208924
GHSA-7q98-jvc7-4p5q
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
3Description
The ReviewX - WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to arbitrary method calls in all versions up to, and including, 2.2.12. This is due to insufficient input validation in the bulkTenReviews function that allows user-controlled data to be passed directly to a variable function call mechanism. This makes it possible for unauthenticated attackers to call arbitrary PHP class methods that take no inputs or have default values, potentially leading to information disclosure or remote code execution depending on available methods and server configuration.
Analysis
The ReviewX plugin for WordPress contains a critical arbitrary method call vulnerability in all versions up to and including 2.2.12. Unauthenticated attackers can exploit insufficient input validation in the bulkTenReviews function to call arbitrary PHP class methods, potentially achieving remote code execution or information disclosure. With a CVSS score of 7.3 and network-based exploitation requiring no privileges or user interaction, this presents a significant risk to WordPress sites using this WooCommerce product review plugin.
Technical Context
This vulnerability affects the ReviewX – WooCommerce Product Reviews plugin (CPE: cpe:2.3:a:reviewx:reviewx_–_multi-criteria_reviews_for_woocommerce_with_google_reviews_&_schema:*:*:*:*:*:*:*:*), a WordPress plugin for managing product reviews with multi-criteria ratings and Google Reviews integration. The root cause is CWE-94 (Improper Control of Generation of Code or 'Code Injection'), specifically manifesting as user-controlled data being passed to variable function calls without proper validation. The bulkTenReviews function in the ReviewController accepts external input that directly controls which PHP class methods are invoked, creating a dangerous method chaining opportunity. References to the source code show the vulnerable code path through routes/api.php, ReviewController.php, ReviewService.php, and Helper.php in version 2.2.7, demonstrating how unsanitized input flows through multiple layers to reach the variable function call mechanism.
Affected Products
ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is affected in all versions up to and including 2.2.12. The vulnerability has been confirmed via CPE designation cpe:2.3:a:reviewx:reviewx_–_multi-criteria_reviews_for_woocommerce_with_google_reviews_&_schema:*:*:*:*:*:*:*:*. Wordfence has published detailed threat intelligence on this vulnerability at https://www.wordfence.com/threat-intel/vulnerabilities/id/0935ede4-05bc-48a2-94a3-8d92002e02bb?source=cve, and the vulnerable code paths are documented in the WordPress plugin repository at https://plugins.trac.wordpress.org/browser/reviewx/tags/2.2.7/ across multiple PHP files including api.php, ReviewController.php, ReviewService.php, and Helper.php.
Remediation
Immediately update the ReviewX plugin to a version newer than 2.2.12 that addresses this vulnerability. Consult the Wordfence threat intelligence page at https://www.wordfence.com/threat-intel/vulnerabilities/id/0935ede4-05bc-48a2-94a3-8d92002e02bb?source=cve for the latest patched version information. Until patching is completed, consider temporarily disabling the ReviewX plugin if not essential for business operations, or implement web application firewall (WAF) rules to block requests to the vulnerable bulkTenReviews endpoint. Organizations should review web server logs for suspicious API requests to routes/api.php endpoints that may indicate exploitation attempts, particularly POST requests with unusual method parameters targeting the ReviewController functionality.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today