CVE-2025-10679: 
WordPress vulnerability analysis and mitigation

CVE-2025-10679 is an arbitrary method call vulnerability in the ReviewX – WooCommerce Product Reviews plugin for WordPress, affecting all versions up to and including 2.2.12. The flaw allows unauthenticated remote attackers to invoke arbitrary PHP class methods, potentially leading to information disclosure or remote code execution depending on available methods and server configuration. It was published on March 23, 2026, and assigned a CVSS v3.1 base score of 7.3 (High) (Wordfence, ENISA EUVD).

The root cause is insufficient input validation (CWE-94: Improper Control of Generation of Code) in the bulkTenReviews function, where user-controlled data is passed directly to a variable function call mechanism without sanitization. This allows an unauthenticated attacker to supply arbitrary class method names that are then invoked by the plugin, provided those methods accept no arguments or have default parameter values. The vulnerable code paths are traceable through the plugin's routes/api.php, app/Rest/Controllers/ReviewController.php, app/Services/ReviewService.php, and app/Utilities/Helper.php files (Wordfence, WordPress Trac).

Successful exploitation can result in information disclosure, integrity compromise, or remote code execution, depending on which PHP class methods are accessible and the server's configuration. Because the attack requires no authentication and no user interaction, any WordPress site running a vulnerable version of ReviewX is exposed to network-based exploitation. The CVSS v3.1 scoring reflects low-level impacts across confidentiality, integrity, and availability, though chaining with other vulnerabilities or exploiting powerful PHP methods could escalate the severity significantly (Wordfence, ENISA EUVD).

No public exploit code or active in-the-wild exploitation has been confirmed as of the time of reporting. The EPSS score is approximately 0.0018 (0.18%), indicating a low but non-negligible probability of exploitation in the near term. The vulnerability has been detected by Qualys scanners and is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence).

1. Reconnaissance: Identify WordPress sites running the ReviewX plugin (versions ≤ 2.2.12) using tools like WPScan, Shodan, or by inspecting plugin directories on publicly accessible sites.
2. Locate the vulnerable endpoint: Target the REST API route handled by bulkTenReviews in routes/api.php, which is accessible without authentication.
3. Craft a malicious request: Send an HTTP POST request to the vulnerable endpoint, supplying a user-controlled parameter that specifies an arbitrary PHP class method name (e.g., a method that returns sensitive configuration data or triggers a destructive action).
4. Trigger arbitrary method call: The plugin passes the attacker-supplied value directly to a variable function call, invoking the specified PHP class method without validation.
5. Achieve objective: Depending on the methods available in the PHP environment, the attacker may extract sensitive information (e.g., database credentials, configuration files) or, in favorable server configurations, achieve remote code execution (Wordfence, WordPress Trac).

• Network: Unusual or repeated unauthenticated POST requests to the ReviewX REST API endpoint (e.g., /wp-json/reviewx/... or similar routes associated with bulkTenReviews) from external IP addresses.
• Logs: WordPress or web server access logs showing unexpected API calls to ReviewX endpoints with suspicious or encoded parameter values; PHP error logs indicating calls to undefined or unexpected class methods.
• File System: Unexpected new files (e.g., web shells) in the WordPress uploads directory or plugin folders following suspicious API activity.
• Process: Unusual PHP child processes spawned by the web server process (e.g., curl, wget, bash) that are not consistent with normal WordPress operation.

Site administrators should update the ReviewX plugin to a version beyond 2.2.12 as soon as a patched release is available from the plugin's official WordPress repository. In the interim, disabling the ReviewX plugin entirely is the most effective workaround to eliminate the attack surface. Additionally, deploying a Web Application Firewall (WAF) — such as Wordfence — with rules targeting this vulnerability can help block exploitation attempts while a patch is applied (Wordfence).

Wordfence, which discovered and reported the vulnerability, included it in their weekly WordPress vulnerability report for the period of March 16–22, 2026, highlighting it as a notable unauthenticated risk for WooCommerce sites (Wordfence Blog). Security aggregators such as RedPacket Security and CVEFeed.io also picked up the disclosure, contributing to broader community awareness shortly after publication.