Flash Notice: WordPress Review Plugin Local File Inclusion

overview

CVE-2025-2158 is a high-severity Local File Inclusion (LFI) vulnerability affecting the "WordPress Review Plugin: The Ultimate Solution for Building a Review Website." This flaw is present in all plugin versions up to and including 5.3.5. It allows authenticated users with Contributor-level access or higher to manipulate post custom fields, enabling the inclusion and execution of arbitrary files on the server. As a result, attackers can execute any PHP code available in those files. The vulnerability is especially hazardous when combined with file upload features or if certain PHP configurations (such as pearcmd and registerargcargv) are enabled.

Potential Impact:

• Arbitrary Code Execution: Attackers can run malicious PHP code, gaining full control of the affected WordPress site.
• Access Control Bypass: Authentication or authorization controls can be bypassed.
• Sensitive Data Disclosure: Confidential server data can be accessed and exfiltrated.
• Persistence and Further Compromise: The vulnerability can be chained with other flaws to establish persistence or enable lateral movement within the server environment.

Exploitation Process:
An authenticated attacker (Contributor-level or above) submits crafted input via post custom fields, triggering local file inclusion and potential code execution. If the server allows PHP file uploads or is configured insecurely (pearcmd and registerargcargv enabled), exploitation risks rise significantly.

Affected Products and Versions:

• Impacted Plugin: WordPress Review Plugin: The Ultimate Solution for Building a Review Website
• Vulnerable Versions: Up to and including 5.3.5
• Patched/Mitigated Versions: No official patch has been publicly cited. Users should monitor plugin repositories and vendor advisories for updates and consider disabling or removing the plugin if a patch is not available.

Threat Status and Exploitation:

• Exploitation in the Wild: No confirmed public reports of exploitation as of this writing, but the vulnerability has a high CVSS score (8.8) and an EPSS score of 0.09%, signaling a significant risk of exploitation.
• Attack Techniques: Authenticated exploitation using Contributor-level accounts, PHP file uploads where enabled, and chaining with insecure PHP settings.

Targeted Sectors: No specific industries have been identified, but any WordPress site using this plugin is at risk due to the plugin’s popularity.

INDICATORS OF COMPROMISE (IOCS)

Currently, there are no documented IoCs linked to successful exploitation of CVE-2025-2158. The vulnerability was publicly disclosed on May 10, 2025, and there is no known proof-of-concept or evidence of active exploitation in the wild at this time. Avertium and the security community remain vigilant and will publicize any IoCs as soon as they emerge.

Vulnerability Summary

• All plugin versions up to and including 5.3.5 are vulnerable.
• Exploitable via post custom fields by authenticated users with Contributor-level access or higher.
• Potential attack outcomes include arbitrary PHP code execution, access control bypass, unauthorized data access, and server compromise if file uploads are enabled.

Mitigation Recommendations

• Update the WordPress Review Plugin to a version newer than 5.3.5 as soon as one is available.
• Restrict administrative access to trusted users.
• Enforce strict file upload controls.
• Utilize WordPress security plugins to add protective layers.
• Remove unnecessary plugin permissions.
• Monitor systems for suspicious file inclusions or unauthorized access attempts.

For ongoing protection and monitoring, Avertium’s Threat Detection & Response (TDR) services can help organizations detect suspicious activities related to this and similar vulnerabilities.

MITRE ATT&CK ttPS

The following MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs) are relevant to the exploitation of CVE-2025-2158:

This vulnerability poses a significant risk by allowing authenticated users with low privileges to fully compromise the WordPress installation and potentially the underlying server.

additional Recommendations + information

Immediate Mitigation Actions

• Restrict Contributor Access: Limit users with Contributor or higher roles, especially on public or multi-author sites.
• Disable Custom Field Inputs: Temporarily disable or restrict post custom field usage within the plugin if feasible.
• Enforce File Upload Restrictions: Allow file uploads only for trusted users, restrict uploads to non-executable file types, and disable PHP file uploads except for administrators.
• Harden PHP Configurations: Disable pearcmd and ensure register_argc_argv=Off to reduce attack surfaces.
• Restrict Admin Interface Exposure: Limit public access to admin panels and backend to trusted IPs.

Patch and Monitoring

• Monitor for Official Patch: Track plugin updates on official repositories and advisory databases like NVD and GitHub.
• Apply Updates Promptly: Patch or remove the plugin as soon as updates are available.
• Monitor File Access: Enable and review logging for all file access/modifications, especially in upload directories. Watch for unauthorized PHP or suspicious files.
• Log User Activity: Actively monitor logins, particularly unusual admin actions or attempts from unfamiliar locations.
• Deploy Security Controls: Utilize a Web Application Firewall (WAF) and security plugins to alert on or block suspicious activities.

Network Security Enhancements

• Block Malicious IPs and Patterns: Use up-to-date threat intelligence to block IP addresses known for exploiting WordPress LFI vulnerabilities.
• Segmentation and Isolation: Isolate vulnerable systems to prevent lateral movement if compromised.
• IDS/IPS Configuration: Detect and prevent LFI attack patterns using IDS/IPS tools. - Monitor Outbound Connections: Be alert for suspicious or unexpected outbound traffic from the web server.

Ongoing Vigilance

Organizations should remain attentive to vendor advisories and implement compensating controls until official patches are available.

ADDITIONAL SERVICE OFFERINGS

Threat Detection & Response (TDR)

Avertium’s TDR service provides continuous, XDR-informed monitoring and response. It detects signs of malicious activity related to local file inclusion, privilege escalation, and unauthorized file execution—critical for identifying and stopping the exploitation of vulnerabilities like CVE-2025-2158. Activity by contributor-level accounts and lateral movement within the environment is also closely monitored for rapid response.

Security Information and Event Management (SIEM)

Avertium integrates SIEM solutions to aggregate and correlate security events across WordPress deployments and supporting infrastructure. This enables rapid detection of unauthorized file inclusions, exploitation attempts, and abnormal access patterns. SIEM supports real-time investigation and compliance reporting.

Cybersecurity Strategy Alignment

Avertium works with organizations to align cybersecurity goals and improve resilience, offering:

• Strategic security assessments
• Threat mapping with frameworks like MITRE ATT&CK
• Cyber maturity roadmaps, including incident response preparation, user training, VCISO support, and continual process improvements targeting web application risks.

Governance, Risk, and Compliance (GRC)

Avertium’s GRC services align security controls with regulatory requirements and best practices. This includes audits and risk assessments for user permissions, file handling, and plugin deployment, enforcing robust security for WordPress environments against LFI risks. Ongoing governance ensures secure configuration baselines and least-privilege enforcement.

Addressing CVE-2025-2158 Risks:

• TDR and SIEM provide active monitoring for exploitation attempts and abnormal contributor account activity.
• ASM ensures all WordPress instances are properly maintained and configured, reducing plugin-based attack surfaces.
• GRC establishes clear policies and access controls to prevent risky activities and maintain compliance.
• Strategic alignment brings vulnerability management, threat intelligence, and continuous improvement into organizational practice.

SUPPORTING DOCUMENTATION

• Wiz Vulnerability Database
• NIST National Vulnerability Database (NVD)
• Red Hat Security Advisory
• CVEDetails
• Feedly CVE Tracker