CVE-2025-2158: LFI in WordPress Review Plugin

The primary impact of CVE-2025-2158 is the potential for arbitrary code execution on a WordPress server. An attacker, having only Contributor-level access, can leverage this LFI vulnerability to include and execute PHP code. This could involve uploading malicious PHP files and then including them through the vulnerable custom fields. Successful exploitation could lead to complete server compromise, including data theft, modification, or deletion. The attacker could also establish a persistent backdoor for future access. The ability to execute arbitrary code bypasses standard WordPress access controls, significantly expanding the attack surface. This vulnerability shares similarities with other LFI exploits where attackers leverage file inclusion to gain unauthorized access and control.

1. Reserved2025-03-10
2. Published2025-05-10
3. Modified2026-04-08
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-2158 is to upgrade the WordPress Review Plugin to a patched version as soon as it becomes available. Until a patch is released, consider disabling the plugin entirely to prevent exploitation. As a temporary workaround, restrict file upload permissions to prevent attackers from uploading malicious PHP files. Implement strict input validation and sanitization on all custom fields to prevent malicious code from being injected. Monitor WordPress logs for suspicious file inclusion attempts. If a rollback is necessary due to a breaking upgrade, revert to a previous, unvulnerable version of the plugin and immediately apply the recommended mitigations.