CVE-2025-10679: RCE in ReviewX WooCommerce Plugin

An unauthenticated attacker can exploit this vulnerability by crafting a malicious request that bypasses input validation in the bulkTenReviews function. This allows them to directly call arbitrary PHP class methods, potentially leading to information disclosure or, more critically, remote code execution on the WordPress server. Successful exploitation could grant an attacker complete control over the affected website, allowing them to modify content, install malware, or steal sensitive data. The impact is particularly severe given the plugin's function of managing product reviews, which often contain customer data and potentially sensitive business information.

1. Reserved2025-09-18
2. Published2026-03-23
3. Modified2026-04-08
4. EPSS updated2026-03-30

The primary mitigation is to immediately upgrade the ReviewX plugin to version 2.3.0 or later, which contains the necessary fix. If upgrading is not immediately feasible, consider implementing a temporary workaround by restricting access to the bulkTenReviews endpoint or implementing stricter input validation on the server-side. Web Application Firewalls (WAFs) can be configured to block requests containing suspicious patterns targeting this function. Monitor WordPress logs for unusual activity or attempts to access the vulnerable endpoint.

Active installs

8KKnown

Plugin rating