CVE-2026-8442: WP Review Slider Pro Arbitrary File Deletion (CVSS 8.1)

Technical summary

CVE-2026-8442 exploits missing authorization validation in the wpfb_hide_review and wprp_save_review_admin AJAX handlers of WP Review Slider Pro. The vulnerable wpfb_hidereview_ajax() function uses strpos() to verify that a stored media URL begins with an expected prefix, but does not properly sanitize path traversal sequences (such as ../) in the remainder of the path before passing it to PHP's unlink() function. This allows an authenticated subscriber-level user to craft requests that traverse directory structures and delete files outside the intended media directory. The CVSS 3.1 score of 8.1 (HIGH) reflects the combination of low attack complexity, network accessibility, and high integrity and availability impact.

Business impact

Deletion of arbitrary files can compromise site availability, data integrity, and security posture. An attacker could remove essential WordPress configuration files, plugins, themes, or database connection files, rendering the site inoperable or forcing extended recovery efforts. By deleting web server files or .htaccess rules, an attacker may create openings for subsequent remote code execution attacks. Organizations relying on this plugin may face unexpected downtime, data loss, and elevated incident response costs.

Affected systems

WP Review Slider Pro versions up to and including 12.6.8 are affected. Any WordPress installation using this plugin with the vulnerable version is at risk if it has users with subscriber-level privileges or higher. Organizations should inventory all instances of WP Review Slider Pro across their WordPress deployments and determine the installed version.

Exploitability

The vulnerability requires authentication (subscriber level or above) and network access, but no user interaction is needed to trigger the file deletion. The low attack complexity and absence of technical barriers to exploitation make this a practical threat once an attacker gains even low-privilege account access. Given that WordPress subscriber accounts are sometimes created for legitimate users or may be leaked through other compromises, the risk is elevated in multi-user environments.

Remediation

Update WP Review Slider Pro to a patched version released after 12.6.8. Verify the exact patch version number against the official plugin advisory from the vendor. Organizations unable to patch immediately should consider temporarily deactivating the plugin, restricting subscriber account creation, or implementing strict AJAX request monitoring for the affected handlers.

Patch guidance

Check the official WP Review Slider Pro plugin page or vendor security advisories for the patched version number. Apply the update through the WordPress admin dashboard or via manual installation, depending on your update policy. Test the patched version in a staging environment first to ensure compatibility with other plugins and customizations. After updating, audit recent user activity logs to detect any suspicious AJAX requests to the vulnerable handlers.

Detection guidance

Monitor web server and WordPress audit logs for AJAX requests to wpfb_hide_review or wprp_save_review_admin endpoints, particularly those originating from subscriber-level users or containing path traversal patterns (../, encoded variants). Log file deletion events at the filesystem level if possible. Check for unexpected removal of WordPress core files, .htaccess, wp-config.php, or other critical files. Enable WordPress debug logging and review it for errors that might indicate exploitation attempts.

Why prioritize this

This vulnerability merits high priority because it combines low barriers to exploitation (authenticated but low-privilege access, no user interaction required) with severe consequences (arbitrary file deletion, potential RCE enablement). The CVSS 8.1 score reflects these factors. Organizations with active user communities or those that distribute subscriber accounts should prioritize patching within days rather than weeks.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) is driven by: Network-accessible attack vector, low attack complexity, low privilege requirement (subscriber level), no user interaction needed, high integrity impact (file deletion), and high availability impact (potential site outage). The absence of confidentiality impact prevents a critical rating. The score reflects a realistic, easily-exploitable flaw with severe consequences.

Frequently asked questions