Executive brief
WP Review Slider Pro is a WordPress plugin used to display customer reviews from various social media platforms. A security flaw in the plugin allows logged-in users with minimal permissions, such as subscribers, to delete files from the website's server. This could lead to a complete site shutdown or allow an attacker to gain further control over the web server.
Technical details
The vulnerability exists within the wpfb_hide_review and wprp_save_review_admin AJAX handlers. The root cause is a combination of missing authorization checks and insufficient path validation in the wpfb_hidereview_ajax() function. While the function uses strpos() to verify that a stored media URL begins with an expected prefix, it fails to sanitize path traversal sequences (e.g., '../') in the remaining path before passing it to the PHP unlink() function. An authenticated attacker with subscriber-level permissions or higher can exploit this to delete arbitrary files on the server. In some configurations, deleting specific configuration files can lead to remote code execution.
Affected products
- WP Review Slider WP Review Slider Pro up to and including 12.6.8
Timeline
- 2026-06-16: advisory: Vulnerability disclosed and CVE assigned