Arbitrary Method Call Vulnerability in ReviewX WooCommerce Plugin for WordPress

CVE-2025-10679

What is CVE-2025-10679?

The ReviewX plugin for WordPress is affected by a vulnerability that enables arbitrary method calls due to inadequate input validation in the bulkTenReviews function. This flaw allows unauthenticated users to send user-controlled data, which can invoke variable function calls without checks. As a result, attackers may exploit this mechanism to execute PHP class methods that either require no parameters or have default ones. Consequently, this could lead to serious risks such as information disclosure or remote code execution, depending on the available methods and the server's configuration.

References