The ReviewX WordPress plugin contains a flaw in its bulkTenReviews function where user input is passed directly to a PHP variable function call. Because no validation is performed, an attacker can supply a function name and cause the plugin to execute that method. The method must have no required parameters or use defaults, but many PHP class methods satisfy that, enabling an attacker to read sensitive data or run arbitrary code. This weakness corresponds to CWE‑94, which concerns code that executes a function based on tainted input.

WordPress sites running the ReviewX – WooCommerce Product Reviews with Multi‑Criteria plugin, version 2.2.12 or earlier, are affected. The plugin adds multi‑criteria review features, reminder emails, Google Reviews integration, and Schema markup to WooCommerce stores. Any WooCommerce installation that has not upgraded beyond 2.2.12 remains exposed to this vulnerability.

The CVSS base score of 7.3 indicates a high severity level. Though no EPSS data is available and the vulnerability is not listed in the CISA KEV catalog, the lack of authentication makes it attractive to attackers. The likely attack vector is an unauthenticated HTTP request to the plugin’s REST API endpoint, where the attacker specifies the function name to be invoked. Successful exploitation would grant the attacker the privileges of the PHP process on the server, potentially allowing remote code execution or information disclosure. Because ReviewX is widely used in WooCommerce stores, the impact can range from local data exposure to full system compromise.