What is the CVSS score of CVE-2026-101160?

CVE-2026-101160 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of WP Ultimate Review are affected by CVE-2026-101160?

The WP Ultimate Review plugin for WordPress, in versions prior to 2.4.4, allows any unauthenticated visitor to permanently break front-end page rendering on sites where the user-review submission…. A patch is available.

Is there a public PoC exploit available for CVE-2026-101160?

Yes, a public proof-of-concept exploit is available for CVE-2026-101160. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-101160?

Within 24 hours, identify every WordPress instance running WP Ultimate Review with a version below 2.4.4 and confirm whether the user-review submission feature is enabled - if it is, that is the exposed population. If immediate patching is not feasible for a given site, temporarily disable or restrict the review submission feature to stop new unvalidated ratings from being stored, and confirm that administrators know to delete any existing review whose rating is not a valid number to restore rendering. Within 7 days, upgrade all affected sites to WP Ultimate Review 2.4.4 or later, following the vendor advisory via WPScan, and verify the update applied by checking the plugin version in the WordPress admin. Within 30 days, validate that patched sites render review content correctly, add plugin version currency to the routine patch-management and vulnerability-scanning baseline, and ensure monitoring can detect a page-rendering failure caused by a malformed stored review so future recurrences are caught and reversed quickly.

WP Ultimate Review CVE-2026-101160

EUVD-2026-91930 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-10-03 WPScan

GHSA-4g77-2gv7-vccg

WordPress Denial Of Service Wp Ultimate Review Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated remote submission over HTTP with no interaction gives AV:N/AC:L/PR:N/UI:N; impact is a persistent fatal-error DoS with no data exposure, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

POC Analysis Generated

Oct 03, 2026 - 19:21 vuln.today

Analysis Generated

Oct 03, 2026 - 16:22 vuln.today

CVSS changed

Oct 03, 2026 - 16:22 NVD

7.5 (HIGH)

Patch available

Oct 03, 2026 - 07:00 EUVD

CVE Published

Oct 03, 2026 - 06:00 cve.org

HIGH 7.5

CVE Published

Oct 03, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review rating is numeric before storing it and later using it in numeric operations when rendering reviews, allowing unauthenticated users to make the reviewed content fail with a fatal error for all visitors until the review is removed (a persistent denial of service), when user reviews are enabled.

AnalysisAI

Unauthenticated visitors can persistently break front-end page rendering on WordPress sites running the WP Ultimate Review plugin before version 2.4.4 whenever the plugin's user-review submission feature is enabled. A submitted review rating that is not a valid number is stored without validation and later fed into numeric operations during review rendering, producing a PHP fatal error that blocks the affected content for every visitor until an administrator deletes the offending review. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires the plugin's user-review submission feature to be enabled (the description explicitly scopes the flaw to 'when user reviews are enabled'), which is the gating configuration prerequisite; sites that do not accept front-end user reviews are not exposed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Signals are internally consistent but point to a moderate, not critical, operational priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: upgrade WP Ultimate Review to version 2.4.4 or later, which adds the numeric validation the plugin was missing before storing review ratings; apply the update through the WordPress plugin dashboard, or via WP-CLI with 'wp plugin update wp-ultimate-review', and verify the installed version afterwards. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify every WordPress instance running WP Ultimate Review with a version below 2.4.4 and confirm whether the user-review submission feature is enabled - if it is, that is the exposed population. …

Threat intelligence, references, and detailed analysis are available after sign-in.