EUVD-2026-37061
GHSA-h2hx-8pjw-mmmw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify WordPress site running WP Review Slider Pro ≤12.6.8
-
DeliveryRegister Subscriber account or reuse credential
-
ExploitAuthenticate to /wp-admin
-
InstallPOST traversal payload to wpfb_hide_review AJAX action
-
C2Trigger unlink() on wp-config.php
-
ExecuteRevisit site to invoke WordPress installer
-
ImpactReinstall with attacker database for admin access and RCE
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated session at the Subscriber role or higher (PR:L), so the practical prerequisite is either that the target WordPress site has 'Anyone can register' enabled in Settings > General (a common default for membership, BuddyPress, WooCommerce, and forum sites) or that the attacker has obtained any low-privilege credential through phishing or credential stuffing. The vulnerable AJAX actions are wpfb_hide_review and wprp_save_review_admin, both reachable over the network via /wp-admin/admin-ajax.php with no user interaction (UI:N) and no scope change. Exploitation is limited to sites running WP Review Slider Pro at version 12.6.8 or earlier with the plugin active; sites that block low-privilege access to admin-ajax.php at the WAF or that disable self-registration substantially constrain reach. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H yields 8.1 (High) and is internally consistent: network-reachable AJAX endpoint, low complexity, and only Subscriber privileges required, with high integrity and availability impact reflecting that an attacker can destroy critical files. The real-world risk is materially gated by whether the target site allows user registration - many production WordPress sites do, especially e-commerce, membership, and community installs. No EPSS score, KEV listing, or public POC was provided, which suggests opportunistic mass exploitation is not yet observed, but Wordfence-reported WordPress plugin file-deletion bugs historically attract automated scanners quickly once details land in feeds. The path from arbitrary delete to RCE via wp-config.php removal is well-documented and reliable on default WordPress installs, so this should be treated as a near-critical priority on any site running the plugin with open registration enabled. |
| Exploit ScenarioDerived | An attacker registers a Subscriber account on a target WordPress site (or compromises an existing low-privilege account), authenticates, and sends a crafted POST to /wp-admin/admin-ajax.php invoking action=wpfb_hide_review with a media URL value containing '../' sequences pointing at wp-config.php. The vulnerable handler passes the unsanitized path to unlink(), removing the configuration file; the attacker then visits the site, which now believes WordPress is uninstalled, and walks through the installation wizard to attach a database they control, granting administrative access and from there full RCE via theme or plugin editing. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Arbitrary file deletion in the WP Review Slider Pro WordPress plugin (versions up to and including 12.6.8) allows authenticated attackers with Subscriber-level access to delete arbitrary files on the underlying server, potentially escalating to remote code execution by removing files such as wp-config.php to trigger the WordPress setup flow. The flaw stems from missing capability checks on two AJAX handlers (wpfb_hide_review and wprp_save_review_admin) combined with a defective strpos()-based prefix check in wpfb_hidereview_ajax() that fails to neutralize path traversal sequences before calling unlink(). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; reported by Wordfence.
RemediationAI
No vendor-released patch identified at time of analysis from the provided references - the Wordfence advisory and vendor site should be consulted directly for a fixed release beyond 12.6.8, and administrators should upgrade as soon as the vendor publishes one. Until a patch is available, disable or remove the WP Review Slider Pro plugin on any site that permits user self-registration, since this transforms the bug from a low-privilege flaw into a near-anonymous one; if removal is not viable, set the 'Anyone can register' option in Settings > General to off and audit existing Subscriber accounts (trade-off: blocks legitimate self-registration flows for membership or WooCommerce customer accounts). As a network-layer mitigation, use a WAF rule to block POST requests to /wp-admin/admin-ajax.php where the action parameter equals wpfb_hide_review or wprp_save_review_admin (trade-off: breaks the plugin's review-hiding workflow for legitimate admins). File-system hardening - making wp-config.php and core WordPress files read-only or owned by a user the PHP process cannot modify - limits the RCE path but does not stop deletion of uploads, themes, or .htaccess.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-22 Path Traversal flaw in a commercial WordPress plugin that ingests and displays third-party review content. The wpfb_hidereview_ajax() function attempts to constrain deletions to media URLs under a known prefix by using PHP's strpos() to verify the supplied path starts with that prefix, but it does not canonicalize the remainder of the string or strip '../' sequences before passing the value to unlink(). Because WordPress AJAX endpoints registered with wp_ajax_<action> hooks are reachable by any logged-in user when the action is not gated by current_user_can() or a properly scoped nonce, the missing authorization on wpfb_hide_review and wprp_save_review_admin lets a Subscriber (the lowest authenticated WordPress role, often self-registerable on sites that permit open registration) reach the vulnerable sink. The CPE entry cpe:2.3:a:https://wpreviewslider.com/:wp_review_slider_pro covers all versions through 12.6.8.
Know when Wpreviewslider Com gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Network-reachable AJAX endpoint (AV:N), trivial traversal payload (AC:L), Subscriber session required (PR:L), no UI; arbitrary delete breaks integrity and availability without disclosing data.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The WP Review Slider Pro plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 12.6.8. This is due to missing authorization checks on the wpfb_hide_review and wprp_save_review_admin AJAX handlers combined with insufficient path validation in the wpfb_hidereview_ajax() function, which uses strpos() to check that a stored media URL starts with the expected prefix but fails to sanitize path traversal sequences in the remaining relative path before passing it to unlink(). This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the affected site's server which may make remote code execution possible.
Executive ViewAI
WP Review Slider Pro WordPress plugin (versions through 12.6.8) allows subscriber-level users to delete arbitrary server files, creating risk of website takeover and complete data loss. Organizations operating WordPress with this plugin face immediate operational and security risk regardless of patch timeline. Remediation cannot await vendor updates given the severity and ease of exploitation by internal or compromised subscriber accounts.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable WP Review Slider Pro on sites where functionality is not essential; (2) remove all non-essential subscriber accounts and restrict Subscriber role to deny file-management capabilities; (3) implement Web Application Firewall rules to block requests to vulnerable AJAX handlers (wpfb_hide_review, wprp_save_review_admin); (4) configure file system permissions-wp-config.php set to 0400 (read-only), restrict /wp-admin directory access by IP; (5) deploy file integrity monitoring to alert on unexpected file deletion events in WordPress root and wp-content directories.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Wpreviewslider Com
View allAuthenticated SQL injection in the WP Review Slider Pro WordPress plugin through version 12.6.8 lets Subscriber-level us
SQL injection in the WP Review Slider Pro WordPress plugin (versions ≤12.6.8) allows authenticated attackers with Subscr
SQL injection in the WP Review Slider Pro WordPress plugin (versions up to and including 12.7.2) lets unauthenticated at
Exploit-DB