Quick answers
- Is CVE-2026-8442 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-8442 being exploited in the wild.
- How severe is CVE-2026-8442?
- High severity, with a CVSS score of 8.1, published 16 June 2026.
- Which products and versions are affected?
- WP Review Slider up to and including 12.6.8; WP Review Slider Pro up to and including 12.6.8.
- Is there a fix for CVE-2026-8442?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-8442 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-8442?
- Check whether you run WP Review Slider or WP Review Slider Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists within the wpfb_hide_review and wprp_save_review_admin AJAX handlers. The root cause is a combination of missing authorization checks and insufficient path validation in the wpfb_hidereview_ajax() function. While the function uses strpos() to verify that a stored media URL begins with an expected prefix, it fails to sanitize path traversal sequences (e.g., '../') in the remaining path before passing it to the PHP unlink() function. An authenticated attacker with subscriber-level permissions or higher can exploit this to delete arbitrary files on the server. In some configurations, deleting specific configuration files can lead to remote code execution.
Affected products
- WP Review Slider WP Review Slider Pro up to and including 12.6.8
Timeline
- 2026-06-16: advisory: Vulnerability disclosed and CVE assigned