Wp Ultimate Review CVE-2026-39644

The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates a network-accessible endpoint requiring no user interaction or privileges, which normally elevates risk; however, the CVSS base score is moderate (5.3) because the confidentiality impact is limited (C:L) and there is no integrity or availability impact (I:N/A:N). The extremely low EPSS score (0.02%, 4th percentile) strongly signals that real-world exploitation is uncommon, suggesting either: (1) the vulnerability is difficult to weaponize in practice despite low technical barriers, (2) the affected functionality is not widely targeted by attackers, or (3) the exposure window is narrow. No public exploit code or active CISA KEV confirmation is provided. This is a classic example of high-CVSS-but-low-real-risk: the attack surface is low-friction, but threat actors have not prioritized this particular plugin vulnerability. Organizations running Wp Ultimate Review should patch, but this is not a critical emergency compared to high-EPSS vulnerabilities.

An unauthenticated attacker probes the Wp Ultimate Review plugin's endpoints (e.g., API routes or admin pages) without logging in and discovers that access control checks are missing, allowing them to read review data, user feedback, or other protected content that should require authentication. Because the attack requires no authentication, complexity, or user interaction, an automated scanner could quickly identify and exploit multiple instances of the vulnerable plugin across the internet; however, the limited confidentiality impact (no data modification, no system compromise) and the rarity of real-world exploitation attempts (EPSS 0.02%) suggest that while technically exploitable, this vulnerability is not actively weaponized at scale.