Skip to main content

WP Ultimate Review CVE-2026-100157

| EUVDEUVD-2026-91965 MEDIUM
Code Injection (CWE-94)
2026-10-03 Wordfence GHSA-cpg8-jrv8-64x9
WordPress RCE Code Injection Wp Ultimate Review Wordpress Plugin Roxnor
6.5
CVSS 3.1 · Vendor: Wordfence
Share

Severity by source

Vendor (Wordfence) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
vuln.today AI
6.5 MEDIUM

Nonce is exposed to anonymous users and reviews auto-publish, so PR:N/UI:N/AC:L over the network; impact limited to shortcode execution, hence C:L/I:L and A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

2
Analysis Generated
Oct 03, 2026 - 07:40 vuln.today
CVE Published
Oct 03, 2026 - 06:38 nvd
MEDIUM 6.5

DescriptionCVE.org

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The nonce required to pass the only gate is emitted to unauthenticated visitors via the public review form, and submitted shortcode payloads are auto-published without admin approval by default, meaning exploitation requires no account and no privileged interaction.

AnalysisAI

Unauthenticated remote attackers can execute arbitrary registered WordPress shortcodes through the WP Ultimate Review plugin (versions up to and including 2.4.3), because the plugin passes an unvalidated value to do_shortcode and the only nonce gate is emitted to anonymous visitors via the public review form, while submitted reviews auto-publish without administrator approval by default. The CVSS 3.1 base score is 6.5 (Medium) with low confidentiality and integrity impact and no availability impact; the real-world severity depends on which shortcodes exist on the target site. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No special conditions beyond default behavior - the vulnerable code path calls do_shortcode on an unvalidated value, and the only gate (a nonce) is emitted to unauthenticated visitors via the public review form, while submitted reviews auto-publish without admin approval by default. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, base 6.5 MEDIUM) and the description are fully consistent: a network-reachable, low-complexity flaw that needs no authentication and no user interaction, because the gating nonce is deliberately emitted to unauthenticated visitors through the public review form and submitted content auto-publishes without admin approval by default. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upstream fix available (PR/commit); released patched version not independently confirmed. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Wp Ultimate Review

View all
CVE-2026-101159 HIGH POC
7.5 Oct 03

Stored cross-site scripting in the WP Ultimate Review WordPress plugin before 2.4.4 lets unauthenticated visitors inject
CVE-2026-101161 HIGH POC
7.5 Oct 03

Unauthenticated attackers can persistently disable affected pages on WordPress sites running the WP Ultimate Review plug
CVE-2026-101160 HIGH POC
7.5 Oct 03

Unauthenticated visitors can persistently break front-end page rendering on WordPress sites running the WP Ultimate Revi
CVE-2026-101162 MEDIUM POC
6.4 Oct 03

Stored cross-site scripting in the WordPress plugin WP Ultimate Review affects all versions before 2.4.4, where some rev
CVE-2023-28987 HIGH
8.8 Nov 12

Cross-Site Request Forgery (CSRF) vulnerability in Wpmet Wp Ultimate Review plugin <= 2.0.3 versions. Rated high severit
CVE-2023-46085 HIGH
8.8 Oct 22

Cross-Site Request Forgery (CSRF) vulnerability in Wpmet Wp Ultimate Review plugin <= 2.2.4 versions. Rated high severit
CVE-2026-92235 HIGH
8.1 Sep 22

Authenticated shortcode injection in the WP Ultimate Review WordPress plugin (Roxnor) allows any user with subscriber-le
CVE-2026-103519 MEDIUM
5.4 Oct 03

Arbitrary shortcode execution in the WP Ultimate Review WordPress plugin through version 2.4.3 lets any authenticated us
CVE-2024-32683 MEDIUM
5.3 Apr 19

Authorization Bypass Through User-Controlled Key vulnerability in Wpmet Wp Ultimate Review.2.5. Rated medium severity (C
CVE-2024-32684 MEDIUM
5.3 Apr 22

Missing Authorization vulnerability in Wpmet Wp Ultimate Review.2.5. Rated medium severity (CVSS 5.3), this vulnerabilit
CVE-2024-21746 MEDIUM
5.3 May 17

Authentication Bypass by Spoofing vulnerability in Roxnor Wp Ultimate Review wp-ultimate-review allows Identity Spoofing
CVE-2026-39644 MEDIUM
5.3 Apr 08

Missing authorization in Roxnor Wp Ultimate Review plugin versions up to 2.3.8 allows unauthenticated remote attackers t

Same weakness CWE-94 – Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2013-3906 HIGH POC
7.8
CVE-2017-9822 HIGH POC
8.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Share

CVE-2026-100157 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy