WP Review Slider Pro <= 12.6.8 Authenticated Arbitrary File Deletion (CVE-2026-8442)

Vulnerability Overview Vulnerability Name: WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) Arbitrary File Deletion via 'myaction' Parameter CVE ID: CVE-2026-8442 CVSS Score: 8.1 (High) Published Date: June 15, 2026 Last Updated: June 16, 2026 Researcher: h0xlo Impact Scope Software Type: Plugin Software Slug: wp-review-slider-pro Affected Versions: <= 12.6.8 Fixed Version: 12.7.0 Remediation Remediation Advice: Update to version 12.7.0 or a newer patched version. Vulnerability Description The WP Review Slider Pro plugin for WordPress contains an arbitrary file deletion vulnerability affecting versions 12.6.8 and below. This vulnerability is caused by a lack of authorization checks in the and handlers, as well as insufficient path validation. Attackers can exploit this vulnerability to delete arbitrary files on the server, potentially leading to remote code execution. References wpreviewslider.com Additional Information CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Related Vulnerabilities: - WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) SQL Injection via 'cursetheme' Parameter (CVE-2026-8444) - WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) SQL Injection via 'stypes' Parameter (CVE-2026-8443) Disclaimer This record contains copyrighted material, the copyright of which belongs to Defiant Inc. and MITRE Corporation. Contact Information For any errors or to add information, please contact: Business Hours 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Customer Support Response: 24/7 support, 365 days a year, with a 1-hour response time Other Links Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Social Media Twitter Facebook LinkedIn Instagram Products and Support Products: - Wordfence Free - Wordfence Premium - Wordfence Care - Wordfence Response - Wordfence CLI - Wordfence Intelligence - Wordfence Central Support: - Documentation - Learning Center - Free Support - Premium Support News: - Blog - In The News - Vulnerability Advisories About: - About Wordfence - Affiliate Program - Employment - Contact - Security - CVE Request Form Subscribe for Updates Register for news and updates provided by experienced security professionals. Email: Agree to terms of service and privacy policy: [ ] By checking this box I agree to the terms of service and privacy policy * Copyright Information © 2012-2026 Defiant Inc. All Rights Reserved Other Wordfence Intelligence Wordfence Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Documentation Learning Center Free Support Premium Support Blog In The News Vulnerability Advisories About Wordfence Affiliate Program Employment Contact Security CVE Request Form Sign Up Wordfence Intelligence Wordfence Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Documentation Learning Center Free Support Premium Support Blog In The News Vulnerability Advisories About Wordfence Affiliate Program Employment Contact Security CVE Request Form Sign Up

Goal Reached Thanks to every supporter — we hit 100%!

WP Review Slider Pro <= 12.6.8 Authenticated Arbitrary File Deletion (CVE-2026-8442)

More from this source