CVE-2025-2158 Details

A local file inclusion vulnerability has been identified in the WordPress Review Plugin: The Ultimate Solution for Building a Review Website, affecting all versions through 5.3.5. The vulnerability arises in the Post custom fields, allowing authenticated attackers with Contributor-level access and above to include and execute arbitrary files on the server. This exploitation can lead to the execution of PHP code contained in the included files, potentially bypassing access controls, accessing sensitive data, or executing code in scenarios where PHP file types can be uploaded and included, or where pearcmd is enabled on a server with register_argc_argv also enabled.