What is the CVSS score of CVE-2026-92235?

CVE-2026-92235 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

How to fix or mitigate CVE-2026-92235?

Within 24 hours, inventory every WordPress instance running WP Ultimate Review (Roxnor) at version 2.4.2 or earlier and restrict subscriber self-registration or disable open registration on any exposed site, since the subscriber-level prerequisite is the primary gate on exploitation; where the plugin is not business-critical, deactivate and remove it immediately. Within 7 days, deploy a web application firewall or reverse-proxy rule that blocks crafted requests to the plugin's action parameters, audit recently registered accounts at subscriber level and above for anomalies, and confirm no unauthorized shortcode-driven changes have appeared in posts, pages, or widget content. Within 30 days, either replace the plugin with a maintained alternative or isolate affected sites behind additional access controls, and continue monitoring the vendor advisory for a fixed release - no vendor-released patch was identified at time of analysis - applying it as soon as one is published and re-validating site content integrity after remediation.

WP Ultimate Review CVE-2026-92235

EUVD-2026-84305 HIGH

Code Injection (CWE-94)

2026-09-22 Wordfence

GHSA-gg2m-8p7j-v3mx

PHP WordPress RCE Code Injection Wp Ultimate Review Wordpress Plugin Roxnor

8.1

CVSS 3.1 · Vendor: Wordfence

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain subscriber-level account on target site
Delivery

Trigger plugin action passing unvalidated value
Exploit

Inject arbitrary shortcode into do_shortcode
Execution

Execute registered shortcodes in site context
Impact

Disclose or manipulate protected data

Vulnerability Assessment

Weakness	CWE CWE-94 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Code injection prevention, sandbox exec MITRE ATT&CK 2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires an authenticated account with subscriber-level access or above on a WordPress site running WP Ultimate Review (by Roxnor) version 2.4.2 or earlier; sites allowing open user registration effectively lower this bar to near-unauthenticated. The attacker must invoke the specific plugin action whose value is passed into do_shortcode without validation (code paths in app/content.php and views/public/meta-box-user-review.php). The concrete impact is bounded by which shortcodes are registered on the target install - arbitrary OS code execution is not guaranteed and depends on the presence of powerful shortcodes from this or other installed plugins/themes. No user interaction is required (UI:N).
Impact	This is a genuine, moderately-high-priority issue but not an urgent widespread emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 8.1) is internally consistent with the description: network-reachable, low complexity, requires only subscriber-level authentication (PR:L), no user interaction, with high confidentiality and integrity impact. No EPSS score, KEV listing, or public POC was provided, so exploitation likelihood signals are absent - this appears to be a Wordfence-reported research finding rather than an actively exploited flaw. The main caveat is impact scope: the CWE is CWE-94 (Code Injection) and the vulnerability is specifically arbitrary shortcode execution via unvalidated do_shortcode, NOT direct OS-level RCE. The realized C:H/I:H impact therefore depends on which shortcodes are registered on the target WordPress install (from this and other plugins/themes); on a hardened site with few sensitive shortcodes the practical impact is lower than the score implies. The 'RCE' tag likely overstates the ceiling. Net: patch promptly because low-privilege authenticated exploitation is realistic on any WordPress site that permits self-registration, but treat 'RCE' as conditional rather than confirmed.
Exploit ScenarioDerived	An attacker registers or already holds a subscriber-level account on a WordPress site running WP Ultimate Review <=2.4.2, then triggers the plugin action that passes an attacker-supplied value into do_shortcode without validation. By injecting arbitrary shortcodes, the attacker invokes any shortcode registered on the site to disclose or manipulate data. No public exploit code was identified at time of analysis, and exploitation requires only low-privilege authentication with no user interaction.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 22, 2026

Authenticated shortcode injection in the WP Ultimate Review WordPress plugin (Roxnor) allows any user with subscriber-level access or higher to run arbitrary registered shortcodes on sites running version 2.4.2 or earlier. The attacker passes a crafted value to a plugin action that feeds it into do_shortcode() without validation (CWE-94), yielding high confidentiality and integrity impact per the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N (8.1). No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV), but on sites with open registration the subscriber prerequisite is trivial to satisfy, and the real-world severity is bounded by which powerful shortcodes are registered by this or other installed plugins and themes - arbitrary operating-system command execution is not guaranteed.

RemediationAI

No vendor-tagged patched release is confirmed in the supplied data; the references include a WordPress plugin Trac changeset (https://plugins.trac.wordpress.org/changeset?reponame=&old=3703958%40wp-ultimate-review&new=3703958%40wp-ultimate-review), so the status is best described as upstream fix available (changeset/commit) with a released patched version not independently confirmed - verify the current plugin version in the WordPress.org directory and update past 2.4.2 as soon as a fixed build is available, checking the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/dc0fe855-97b7-46ef-b1c8-1602447e97e6?source=cve) for the definitive fixed version. If an update is not yet possible, deactivate WP Ultimate Review entirely - the only fully effective mitigation, at the cost of losing its review functionality - or, if it must stay live, close self-registration and lower every non-administrative account to the least privilege available so subscriber-level users cannot reach the vulnerable action; note that this fails against any already-provisioned low-privilege account. Complementary controls include restricting access to the plugin's AJAX/REST action endpoints and the review meta-box submission paths at the reverse proxy or WAF (blocking requests containing shortcode markers such as bracketed shortcode syntax in those parameters), and auditing which shortcodes are registered by other active plugins and themes so the practical payload space is understood. Each compensating control has a trade-off: disabling the plugin removes functionality, registration lockdown is not retroactive, and WAF or proxy filtering can be evaded with encoding tricks and may break legitimate review submissions that contain bracket characters.

Affected VersionsENISA

Wp Ultimate Review 0 ≤2.4.2

Affected Packages

euvd wp_ultimate_review no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The flaw is a code-injection class issue (CWE-94) in WordPress shortcode handling. WordPress themes and plugins expose functionality through shortcodes such as [shortcode attr="value"], which are rendered by the core do_shortcode() function; passing unsanitized user input into that function lets an attacker invoke any shortcode registered anywhere on the install, including shortcodes that read or write files, run database queries, or execute code. In WP Ultimate Review, the plugin's action handlers accept a value and forward it to do_shortcode without validating or restricting it. The referenced source locations - app/content.php lines 56, 189, 341 and 360, init.php line 271, and views/public/meta-box-user-review.php line 538 in tag 2.4.2 - mark both the untrusted input entry points and the do_shortcode call sites that make this exploitable. The CPE cpe:2.3:a:roxnor:wp_ultimate_review:*:*:*:*:*:*:*:* records all versions of the Roxnor plugin as the affected namespace, consistent with the advisory statement that every version up to and including 2.4.2 is vulnerable. Because the capability granted is 'invoke any registered shortcode' rather than a fixed payload, the practical blast radius depends on the target's plugin/theme inventory rather than on a hardcoded vulnerable primitive.

Know when Wp Ultimate Review gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Wordfence) PRIMARY 8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI 8.1 HIGH

Low-privilege subscriber account suffices (PR:L), remotely reachable with no interaction; shortcode execution can read and alter data (C:H/I:H), availability not directly affected, though realized impact varies by installed shortcodes.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

DescriptionCVE.org

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.

Articles & Coverage 1

News 17 New WordPress Vulnerabilities - 17 High Severity, 2 With POC Sep 23, 2026

Executive ViewAI

Why It Matters

The WP Ultimate Review plugin (Roxnor), versions 2.4.2 and earlier, contains an authenticated shortcode injection flaw that lets any user with a subscriber-level account - the lowest tier of WordPress access and one that anyone can self-provision on sites with open registration - execute arbitrary registered shortcodes, potentially exposing or altering site content and data. No vendor patch is currently available, so every WordPress site running this plugin at or below the affected version remains exposed until it is removed or otherwise mitigated. Leadership should care because the exposure is broad and low-effort to trigger, and the ultimate blast radius depends on which other plugins and themes are installed, meaning the risk profile varies across the estate and cannot be assessed from this plugin alone.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: disable open registration and tighten subscriber-level account provisioning; deactivate or uninstall the WP Ultimate Review plugin where feasible; apply WAF/reverse-proxy rules filtering crafted input to the plugin's action parameters; minimize the set of installed plugins and themes that register powerful shortcodes, which bounds the achievable impact; and monitor registered subscriber accounts and site content for unauthorized changes.

Threat Intelligence Overview

EPSS Score

0.4%

Top 70% exploitable

Prevalence

Low

moderate-footprint WordPress review plugin by a single vendor

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.4%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +40

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.