The WordPress Review Plugin: The Ultimate Solution for Building a Review Website contains a local file inclusion flaw in all versions up to 5.3.5, enabling authenticated users with at least Contributor privileges to include and execute arbitrary files on the server. This permits code execution, enabling attackers to bypass existing access controls, exfiltrate data or leverage uploaded PHP files for further compromise. The vulnerability is an example of improper validation of file paths, classified as CWE-22.

The flaw affects the WordPress Review Plugin by the mythemeshop vendor, specifically all releases 5.3.5 and earlier. Users running these plugin versions on any WordPress site are impacted.

The CVSS score of 8.8 reflects a severe risk, but the EPSS of < 1% indicates that exploitation is considered unlikely at the moment. The vulnerability is not listed in the CISA KEV catalog, so there is no evidence of known widespread active exploitation. The likely attack vector is as follows: an adversary authenticates to the WordPress dashboard with Contributor or higher rights and manipulates post custom fields to supply a file path that is then resolved by the plugin, resulting in PHP code execution. Because the flaw relies on valid authentication, the threat surface is limited to compromised or stolen credentials.