CVE-2026-8442 is a path traversal vulnerability in the WP Review Slider Pro WordPress plugin. The issue arises from missing authorization checks on the wpfb_hide_review and wprp_save_review_admin AJAX handlers combined with inadequate validation in the wpfb_hidereview_ajax() function. This function uses strpos() to verify that a stored media URL starts with an expected prefix but fails to sanitize path traversal sequences in the relative path before passing it to unlink(). As a result, authenticated attackers with subscriber-level privileges can delete arbitrary files on the server, potentially enabling remote code execution.

An attacker with subscriber-level access or higher can delete arbitrary files on the affected server. This can lead to denial of service or facilitate remote code execution if critical files are removed or manipulated. The vulnerability does not impact confidentiality but has high integrity and availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level user permissions where possible and monitor for suspicious activity related to file deletions via the affected AJAX handlers.