The WordPress Review Plugin: The Ultimate Solution for Building a Review Website contains a Local File Inclusion vulnerability (CWE-22) in all versions up to 5.3.5. Authenticated attackers with Contributor-level privileges can exploit this via Post custom fields to include and execute arbitrary files on the server. This enables execution of PHP code within those files, which may allow bypassing access controls, data disclosure, or full code execution if PHP file uploads are possible or certain PHP configurations (pearcmd and register_argc_argv) are enabled. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation allows an authenticated user with Contributor or higher privileges to execute arbitrary PHP code on the server. This can lead to bypassing access controls, unauthorized data access, and potentially full system compromise depending on server configuration. The vulnerability impacts confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level user capabilities if possible and monitor for suspicious activity related to file inclusion attempts. Avoid enabling PHP configurations such as pearcmd and register_argc_argv that increase risk. Follow vendor updates closely for an official patch or temporary mitigation.