CVE-2025-7327
📋 TL;DR
The Widget for Google Reviews WordPress plugin contains a directory traversal vulnerability that allows authenticated attackers with Subscriber-level access or higher to include and execute arbitrary PHP files on the server. This can lead to remote code execution, data theft, and access control bypass. All WordPress sites using this plugin up to version 1.0.15 are affected.
💻 Affected Systems
- Widget for Google Reviews WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through arbitrary PHP code execution, leading to data exfiltration, backdoor installation, and lateral movement within the network.
Likely Case
Unauthorized access to sensitive files, privilege escalation, and installation of web shells for persistent access.
If Mitigated
Limited impact if proper file permissions and web application firewalls are in place, though some information disclosure may still occur.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once credentials are obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.16 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Widget for Google Reviews' and click 'Update Now'. 4. Verify version is 1.0.16 or higher.
🔧 Temporary Workarounds
Disable plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate business-reviews-wp
Restrict user roles
allRemove Subscriber role access or restrict user registration
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block directory traversal attempts
- Restrict file permissions on web server to prevent PHP execution in upload directories
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Installed Plugins for 'Widget for Google Reviews' version 1.0.15 or lowerCheck Version:
wp plugin get business-reviews-wp --field=versionVerify Fix Applied:
Confirm plugin version is 1.0.16 or higher in WordPress admin panel📡 Detection & Monitoring
Log Indicators:
- Unusual file inclusion requests with '../' sequences in layout parameter
- PHP file execution from unexpected directories
Network Indicators:
- HTTP requests containing directory traversal sequences in URL parameters
SIEM Query:
web.url:*layout=*..%2F* OR web.url:*layout=*%2F..%2F*