CVE-2025-2158: WordPress Review Plugin LFI/RCE Vulnerability

CVE-2025-2158 Overview

CVE-2025-2158 is a Local File Inclusion (LFI) vulnerability in the WP Review Plugin: The Ultimate Solution for Building a Review Website for WordPress. The flaw affects all versions up to and including 5.3.5 and stems from unsafe handling of Post custom fields. Authenticated attackers with Contributor-level access or higher can include and execute arbitrary files on the server. Successful exploitation enables execution of PHP code contained in those files, bypassing access controls and exposing sensitive data. The vulnerability is tracked under [CWE-22] (Path Traversal).

Critical Impact
Authenticated attackers can include arbitrary local files and execute PHP code on the server, leading to access control bypass, sensitive data exposure, and potential remote code execution when combined with file upload or pearcmd techniques.

Affected Products

WP Review Plugin: The Ultimate Solution for Building a Review Website (WordPress plugin)
All plugin versions up to and including 5.3.5
WordPress sites granting Contributor-level access or higher to untrusted users

Discovery Timeline

2025-05-10 - CVE-2025-2158 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2158

Vulnerability Analysis

The vulnerability resides in how the WP Review plugin processes Post custom fields when rendering review content. User-controlled values supplied through custom fields are passed into file inclusion logic without sufficient sanitization or path validation. An attacker who can author or edit posts can set a custom field value that points to an arbitrary file path on the server.

When the plugin processes the post, the supplied path is included via PHP file inclusion functions. This causes the targeted file to be evaluated as PHP. The current EPSS probability is 0.688%, reflecting moderate prediction of near-term exploitation activity. Technical sources for the affected code paths include the WordPress Function File and the WordPress Shortcode File.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The plugin trusts attacker-controllable custom field input and passes it to a PHP include or require operation without enforcing an allowlist, canonicalizing the path, or restricting the target directory.

Attack Vector

The attack vector is network-based and requires an authenticated session with Contributor privileges or higher. The attacker creates or edits a post and sets a malicious custom field value referencing a local file. When the review content is rendered, the plugin includes and executes the targeted file. Exploitation can escalate to remote code execution where PHP file uploads are permitted, or where pearcmd.php exists on the server with register_argc_argv enabled.

No verified public exploit code is available. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-2158

Indicators of Compromise

Post custom field values containing path traversal sequences such as ../, absolute filesystem paths, or references to pearcmd.php
Unexpected PHP file reads or includes targeting paths outside the WordPress plugin directory in web server or PHP error logs
New or modified PHP files in the WordPress uploads directory authored by Contributor-level accounts
Outbound network connections originating from the WordPress PHP worker process to attacker-controlled hosts

Detection Strategies

Audit WordPress postmeta entries associated with the WP Review plugin for suspicious file path values
Monitor PHP include, require, and equivalent file inclusion calls for non-plugin path arguments via runtime application self-protection or PHP audit logging
Correlate Contributor-level post creation events with web server access entries that render the affected review pages

Monitoring Recommendations

Enable detailed access logging on WordPress endpoints rendering review posts and alert on anomalous response sizes or PHP errors
Track creation and modification of low-privilege user accounts, particularly Contributors and Authors
Forward WordPress, PHP-FPM, and web server logs to a centralized analytics platform for correlation against LFI patterns

How to Mitigate CVE-2025-2158

Immediate Actions Required

Update the WP Review plugin to a version newer than 5.3.5 as soon as a patched release is available from the vendor
Audit all Contributor-level and higher accounts and remove or disable accounts that are not strictly required
Review existing review posts and custom field entries for malicious payloads and remove any suspicious content
Restrict file upload permissions and disable execution of PHP within the WordPress uploads directory

Patch Information

At the time of publication, administrators should consult the Wordfence Vulnerability Report and the WordPress plugin repository for the latest fixed release. Apply the vendor patch through the WordPress plugin update interface or via WP-CLI as soon as it becomes available.

Workarounds

Deactivate and remove the WP Review plugin until a patched version is installed
Restrict Contributor and Author roles using a capability management plugin to prevent custom field editing
Disable register_argc_argv in PHP configuration and remove pearcmd.php from production servers to limit LFI-to-RCE escalation paths
Deploy web application firewall rules that block path traversal sequences in WordPress POST parameters and custom field values

bash

# Configuration example: harden PHP and WordPress against LFI escalation
# /etc/php.d/99-hardening.ini
register_argc_argv = Off
allow_url_include = Off
open_basedir = "/var/www/html:/tmp"

# Block PHP execution in WordPress uploads (Apache .htaccess)
# /var/www/html/wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|php5|php7|phar)$">
    Require all denied
</FilesMatch>

# Update the plugin once a patched release is available
wp plugin update wp-review