Directory Traversal Vulnerability in Widget for Google Reviews Plugin by WordPress

CVE-2025-7327

What is CVE-2025-7327?

The Widget for Google Reviews plugin for WordPress has a Directory Traversal vulnerability that affects all versions up to and including 1.0.15. Through manipulation of the layout parameter, authenticated attackers with Subscriber-level access and higher can include and execute arbitrary files on the server. This flaw allows attackers to bypass access controls and potentially execute PHP code from uploaded files, putting sensitive data at risk. The vulnerability is particularly concerning as it lets attackers leverage image uploads and other seemingly safe file types to execute malicious PHP code.

References