CVE-2025-10679: ReviewX WordPress Plugin RCE Vulnerability

CVE-2025-10679 Overview

The ReviewX – WooCommerce Product Reviews plugin for WordPress contains a critical arbitrary method call vulnerability affecting all versions up to and including 2.2.12. This vulnerability stems from insufficient input validation in the bulkTenReviews function, which allows user-controlled data to be passed directly to a variable function call mechanism. Unauthenticated attackers can exploit this flaw to call arbitrary PHP class methods that take no inputs or have default values, potentially leading to information disclosure or remote code execution depending on available methods and server configuration.

Critical Impact

Unauthenticated attackers can invoke arbitrary PHP class methods without authentication, potentially achieving remote code execution or sensitive information disclosure on vulnerable WordPress installations.

Affected Products

• ReviewX – WooCommerce Product Reviews plugin for WordPress versions up to and including 2.2.12
• WordPress sites with ReviewX plugin installed
• WooCommerce deployments utilizing ReviewX for product reviews

Discovery Timeline

• 2026-03-23 - CVE-2025-10679 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2025-10679

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code - Code Injection). The flaw resides in the ReviewX plugin's review handling functionality, specifically within the bulkTenReviews function. The vulnerable code path allows attackers to manipulate input parameters that are subsequently used in a variable function call mechanism without proper validation or sanitization.

The attack can be executed over the network without requiring any authentication or user interaction. The vulnerability affects the confidentiality, integrity, and availability of the target system, as successful exploitation could allow attackers to execute arbitrary PHP methods, potentially leading to complete system compromise depending on the available class methods and server environment.

Root Cause

The root cause of this vulnerability is insufficient input validation in the plugin's REST API endpoint handling. User-supplied data is passed to a variable function call mechanism without adequate sanitization, allowing attackers to specify which PHP class methods should be invoked. The vulnerable code path spans multiple files in the plugin architecture:

• The ReviewController.php handles incoming API requests
• The ReviewService.php processes review-related operations
• The Helper.php utility contains helper functions that can be invoked
• The api.php routes file defines the vulnerable endpoint

Attack Vector

The attack is network-based and requires no authentication, making it particularly dangerous for public-facing WordPress installations. An attacker can craft malicious HTTP requests to the plugin's REST API endpoints, manipulating parameters to invoke arbitrary PHP class methods. The attack complexity is low, and no user interaction is required for successful exploitation.

The exploitation flow typically involves:

1. Identifying WordPress installations with the vulnerable ReviewX plugin version
2. Crafting malicious API requests targeting the bulkTenReviews function
3. Specifying method names to be invoked through the variable function call mechanism
4. Methods that accept no parameters or have default values can be successfully called
5. Depending on server configuration and available methods, attackers may achieve code execution or information disclosure

For detailed technical analysis of the vulnerable code paths, refer to the WordPress ReviewController Code and Wordfence Vulnerability Report.

Detection Methods for CVE-2025-10679

Indicators of Compromise

• Unusual HTTP POST/GET requests to ReviewX REST API endpoints containing unexpected method parameters
• Anomalous PHP method invocations in web server logs, particularly targeting the bulkTenReviews endpoint
• Unexpected file system changes or new files created by the web server process
• Evidence of information disclosure attempts such as configuration file access or database enumeration

Detection Strategies

• Monitor WordPress REST API logs for requests to /wp-json/reviewx/ endpoints with suspicious parameter values
• Implement Web Application Firewall (WAF) rules to detect and block requests containing potential method injection patterns
• Enable verbose PHP logging to capture unexpected method calls and their parameters
• Use file integrity monitoring to detect unauthorized changes to WordPress core and plugin files

Monitoring Recommendations

• Configure centralized logging for all WordPress API requests and review for anomalous patterns
• Set up alerts for failed authentication attempts followed by successful API calls to ReviewX endpoints
• Monitor server resource utilization for signs of post-exploitation activity such as cryptomining or data exfiltration
• Implement network traffic analysis to detect potential command and control communications

How to Mitigate CVE-2025-10679

Immediate Actions Required

• Update the ReviewX plugin to the latest patched version immediately (version 2.2.13 or later)
• If immediate patching is not possible, temporarily disable the ReviewX plugin until the update can be applied
• Review web server logs for any evidence of exploitation attempts against the vulnerable endpoints
• Consider implementing additional access controls or WAF rules to restrict access to the plugin's REST API

Patch Information

The vulnerability affects ReviewX versions up to and including 2.2.12. Users should update to the latest available version that addresses this security issue. The patch implements proper input validation to prevent user-controlled data from being passed to the variable function call mechanism. For more details, consult the Wordfence Vulnerability Report.

Workarounds

• Temporarily disable the ReviewX plugin if patching is not immediately possible
• Implement WAF rules to block requests containing suspicious parameters to ReviewX API endpoints
• Restrict access to WordPress REST API endpoints using .htaccess or server configuration rules
• Consider using a WordPress security plugin with virtual patching capabilities to protect against this vulnerability

# Example .htaccess rule to restrict ReviewX API access
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} ^/wp-json/reviewx/ [NC]
    RewriteCond %{REMOTE_ADDR} !^192\.168\.1\. [NC]
    RewriteRule .* - [F,L]
</IfModule>