What is the CVSS score of CVE-2026-101161?

CVE-2026-101161 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of WP Ultimate Review are affected by CVE-2026-101161?

WordPress sites using the WP Ultimate Review plugin before version 2.4.4 face a persistent availability disruption that can disable review pages, affecting customer-facing content and potentially…. A patch is available.

Is there a public PoC exploit available for CVE-2026-101161?

Yes, a public proof-of-concept exploit is available for CVE-2026-101161. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-101161?

Within 24 hours, inventory all WordPress installations for the WP Ultimate Review plugin and update every instance below version 2.4.4 to version 2.4.4 or later; vendor-released patch: 2.4.4. If immediate patching is not possible, temporarily disable the plugin on affected sites or save the review display settings to remove the default unconfigured state. Within 7 days, verify that all production, staging, and development environments are patched, and confirm review pages remain functional; scan for residual vulnerable instances using WPScan or equivalent tooling. Within 30 days, integrate this plugin into routine patch management and configuration validation, ensuring review display settings are saved and monitoring is in place for availability incidents on review pages.

WP Ultimate Review CVE-2026-101161

EUVD-2026-91931 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-10-03 WPScan

GHSA-7j5c-34gf-rc4m

WordPress Denial Of Service Wp Ultimate Review Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote unauthenticated submission with no interaction yields AV:N/AC:L/PR:N/UI:N; impact is a persistent fatal-error DoS, so A:H with C:N/I:N and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

POC Analysis Generated

Oct 03, 2026 - 19:21 vuln.today

Analysis Generated

Oct 03, 2026 - 16:22 vuln.today

CVSS changed

Oct 03, 2026 - 16:22 NVD

7.5 (HIGH)

Patch available

Oct 03, 2026 - 07:00 EUVD

CVE Published

Oct 03, 2026 - 06:00 cve.org

HIGH 7.5

CVE Published

Oct 03, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visit, resulting in a persistent denial of service when the WP Ultimate Review WordPress plugin before 2.4.4's review display settings have never been saved.

AnalysisAI

Unauthenticated attackers can persistently disable affected pages on WordPress sites running the WP Ultimate Review plugin before 2.4.4 by submitting crafted review content that is stored and then triggers a fatal error on every subsequent page load. Confirmed exploitation conditions require the plugin to be installed and its review display settings to have never been saved (default unconfigured state); no authentication, user interaction, or non-default toggles are needed, and the impact is availability-only with no data compromise. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires that the WP Ultimate Review plugin (before 2.4.4) be installed and that its review display settings have NEVER been saved - i.e. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Multiple signals converge on this being a genuine but moderate-severity availability issue rather than a top-tier emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: upgrade WP Ultimate Review to version 2.4.4 or later, then verify the plugin's review display settings are saved once after the update so the vulnerable rendering state no longer applies; see the WPScan advisory at https://wpscan.com/vulnerability/c1c3e2d7-4833-4e51-a3c7-45e6d036a525/. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all WordPress installations for the WP Ultimate Review plugin and update every instance below version 2.4.4 to version 2.4.4 or later; vendor-released patch: 2.4.4. …

Threat intelligence, references, and detailed analysis are available after sign-in.