WP Review Slider Pro Plugin up to 12.6.8 on WordPress AJAX wpfb_hidereview_ajax path traversal

Summaryinfo

A vulnerability was found in WP Review Slider Pro Plugin up to 12.6.8 on WordPress and classified as critical. Affected by this issue is the function wpfb_hidereview_ajax of the component AJAX Handler. Executing a manipulation can lead to path traversal. The identification of this vulnerability is CVE-2026-8442. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in WP Review Slider Pro Plugin up to 12.6.8 on WordPress. It has been declared as critical. This vulnerability affects the function wpfb_hidereview_ajax of the component AJAX Handler. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect integrity, and availability. CVE summarizes:

The WP Review Slider Pro plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 12.6.8. This is due to missing authorization checks on the wpfb_hide_review and wprp_save_review_admin AJAX handlers combined with insufficient path validation in the wpfb_hidereview_ajax() function, which uses strpos() to check that a stored media URL starts with the expected prefix but fails to sanitize path traversal sequences in the remaining relative path before passing it to unlink(). This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the affected site's server which may make remote code execution possible.

The weakness was shared by Phú. The advisory is shared for download at wordfence.com. This vulnerability was named CVE-2026-8442 since 05/12/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 06/16/2026). The MITRE ATT&CK project declares the attack technique as T1006.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-37061). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Feedback Software

Name

• WP Review Slider Pro Plugin

Version

• 12.6.0
• 12.6.1
• 12.6.2
• 12.6.3
• 12.6.4
• 12.6.5
• 12.6.6
• 12.6.7
• 12.6.8

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion