CVE-2026-8442

Name of the Vulnerable Software and Affected Versions WP Review Slider Pro versions prior to 12.6.9

Description The WP Review Slider Pro plugin for WordPress allows authenticated attackers with subscriber-level access and above to delete arbitrary files on the server. This occurs due to missing authorization checks on the 'wpfb hide review' and 'wprp save review admin' AJAX handlers, combined with insufficient path validation in the wpfb hidereview ajax() function. The function uses strpos() to verify that a stored media URL starts with the expected prefix but fails to sanitize path traversal sequences—techniques used to access files outside the intended directory—in the remaining relative path before it is passed to unlink(). This flaw may lead to remote code execution.

Recommendations Update to a version later than 12.6.8. As a temporary workaround, restrict access to the 'wpfb hide review' and 'wprp save review admin' AJAX handlers to minimize the risk of exploitation.