The ReviewX plugin for WooCommerce contains a code injection vulnerability (CWE-94) due to insufficient input validation in the bulkTenReviews function. This flaw permits unauthenticated attackers to pass user-controlled data to a variable function call mechanism, enabling arbitrary method calls on PHP classes that accept no inputs or have default parameters. Exploitation could result in information disclosure or remote code execution depending on the invoked methods and server configuration. The vulnerability affects all versions up to and including 2.2.12. The CVSS 3.1 base score is 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated attackers to execute arbitrary PHP class methods, potentially leading to information disclosure or remote code execution. This can compromise the confidentiality, integrity, and availability of the affected system. The severity is high based on the CVSS score of 7.3. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable bulkTenReviews functionality if possible. Monitor vendor channels for updates and apply patches promptly once available.