CVE-2025-10679: ReviewX WordPress Plugin RCE Vulnerability

CVE-2025-10679 Overview

The ReviewX – WooCommerce Product Reviews plugin for WordPress contains a critical arbitrary method call vulnerability affecting all versions up to and including 2.2.12. This vulnerability stems from insufficient input validation in the bulkTenReviews function, which allows user-controlled data to be passed directly to a variable function call mechanism. Unauthenticated attackers can exploit this flaw to call arbitrary PHP class methods that take no inputs or have default values, potentially leading to information disclosure or remote code execution depending on available methods and server configuration.

Critical Impact
Unauthenticated attackers can invoke arbitrary PHP class methods without authentication, potentially achieving remote code execution or sensitive information disclosure on vulnerable WordPress installations.

Affected Products

ReviewX – WooCommerce Product Reviews plugin for WordPress versions up to and including 2.2.12
WordPress sites with ReviewX plugin installed
WooCommerce deployments utilizing ReviewX for product reviews

Discovery Timeline

2026-03-23 - CVE-2025-10679 published to NVD
2026-03-23 - Last updated in NVD database

Technical Details for CVE-2025-10679

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code - Code Injection). The flaw resides in the ReviewX plugin's review handling functionality, specifically within the bulkTenReviews function. The vulnerable code path allows attackers to manipulate input parameters that are subsequently used in a variable function call mechanism without proper validation or sanitization.

The attack can be executed over the network without requiring any authentication or user interaction. The vulnerability affects the confidentiality, integrity, and availability of the target system, as successful exploitation could allow attackers to execute arbitrary PHP methods, potentially leading to complete system compromise depending on the available class methods and server environment.

Root Cause

The root cause of this vulnerability is insufficient input validation in the plugin's REST API endpoint handling. User-supplied data is passed to a variable function call mechanism without adequate sanitization, allowing attackers to specify which PHP class methods should be invoked. The vulnerable code path spans multiple files in the plugin architecture:

The ReviewController.php handles incoming API requests
The ReviewService.php processes review-related operations
The Helper.php utility contains helper functions that can be invoked
The api.php routes file defines the vulnerable endpoint

Attack Vector

The attack is network-based and requires no authentication, making it particularly dangerous for public-facing WordPress installations. An attacker can craft malicious HTTP requests to the plugin's REST API endpoints, manipulating parameters to invoke arbitrary PHP class methods. The attack complexity is low, and no user interaction is required for successful exploitation.

The exploitation flow typically involves:

Identifying WordPress installations with the vulnerable ReviewX plugin version
Crafting malicious API requests targeting the bulkTenReviews function
Specifying method names to be invoked through the variable function call mechanism
Methods that accept no parameters or have default values can be successfully called
Depending on server configuration and available methods, attackers may achieve code execution or information disclosure

For detailed technical analysis of the vulnerable code paths, refer to the WordPress ReviewController Code and Wordfence Vulnerability Report.

Detection Methods for CVE-2025-10679

Indicators of Compromise

Unusual HTTP POST/GET requests to ReviewX REST API endpoints containing unexpected method parameters
Anomalous PHP method invocations in web server logs, particularly targeting the bulkTenReviews endpoint
Unexpected file system changes or new files created by the web server process
Evidence of information disclosure attempts such as configuration file access or database enumeration

Detection Strategies

Monitor WordPress REST API logs for requests to /wp-json/reviewx/ endpoints with suspicious parameter values
Implement Web Application Firewall (WAF) rules to detect and block requests containing potential method injection patterns
Enable verbose PHP logging to capture unexpected method calls and their parameters
Use file integrity monitoring to detect unauthorized changes to WordPress core and plugin files

Monitoring Recommendations

Configure centralized logging for all WordPress API requests and review for anomalous patterns
Set up alerts for failed authentication attempts followed by successful API calls to ReviewX endpoints
Monitor server resource utilization for signs of post-exploitation activity such as cryptomining or data exfiltration
Implement network traffic analysis to detect potential command and control communications

How to Mitigate CVE-2025-10679

Immediate Actions Required

Update the ReviewX plugin to the latest patched version immediately (version 2.2.13 or later)
If immediate patching is not possible, temporarily disable the ReviewX plugin until the update can be applied
Review web server logs for any evidence of exploitation attempts against the vulnerable endpoints
Consider implementing additional access controls or WAF rules to restrict access to the plugin's REST API

Patch Information

The vulnerability affects ReviewX versions up to and including 2.2.12. Users should update to the latest available version that addresses this security issue. The patch implements proper input validation to prevent user-controlled data from being passed to the variable function call mechanism. For more details, consult the Wordfence Vulnerability Report.

Workarounds

Temporarily disable the ReviewX plugin if patching is not immediately possible
Implement WAF rules to block requests containing suspicious parameters to ReviewX API endpoints
Restrict access to WordPress REST API endpoints using .htaccess or server configuration rules
Consider using a WordPress security plugin with virtual patching capabilities to protect against this vulnerability

bash

# Example .htaccess rule to restrict ReviewX API access
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} ^/wp-json/reviewx/ [NC]
    RewriteCond %{REMOTE_ADDR} !^192\.168\.1\. [NC]
    RewriteRule .* - [F,L]
</IfModule>