The WP Review Slider Pro plugin contains an authorization flaw that allows authenticated users with subscriber or higher privileges to delete any file on the webserver using the wpfb_hide_review and wprp_save_review_admin AJAX handlers. The flaw stems from insufficient validation of the file path supplied to unlink(), which uses strpos() without sanitizing path traversal sequences. Successful exploitation removes critical files and can create a foothold for remote code execution if the attacker controls the deleted file content or replacement. This represents a serious breach of file system integrity and confidentiality.

WordPress sites that utilize the WP Review Slider Pro plugin in any version up to and including 12.6.8 are affected. The vulnerability is tied to the plugin’s AJAX functionality and impacts all sites that have the plugin installed regardless of site theme or other plugins.

The CVSS base score of 8.1 indicates high severity, while the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not yet listed in CISA’s KEV catalog, but the lack of authorization checks combined with path validation weaknesses means that once a subscriber account is compromised, an attacker can delete arbitrary server files. Given the data, the most likely attack vector is internal or authenticated, where a legitimate user can trigger the vulnerable endpoint. Explaination of exploit is limited to the plugin’s unprotected AJAX endpoints and the missing path sanitization that allows deletion of any file reachable by the web process.