WP Ultimate Review EUVD-2026-108009

Exploitation requires that the plugin's user-review feature is enabled AND that the specific vulnerable review field is configured to be displayed; the review form itself is public and reachable by unauthenticated visitors on sites running WP Ultimate Review before 2.4.5. The practical impact is limited by which shortcodes are registered on the target WordPress site, and by the requirement that the affected field actually be rendered to a viewer; the CVSS AC:H reflects these configuration-dependent preconditions. These are the limiting factors defenders should weigh: it only bites where reviews and that field's display are turned on.

This is a moderate-severity stored shortcode injection (CWE-94) in the WP Ultimate Review WordPress plugin, carrying a CVSS 3.1 base score of 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). The signals point to a real but bounded issue rather than an emergency. In its favour for attackers: the attack vector is network-based and the vulnerable review form is unauthenticated (PR:N/UI:N), so no credentials or victim interaction are needed to plant the payload. Tempering the risk: AC:H reflects that exploitation depends on non-default conditions (user reviews must be enabled and the affected field's display must be enabled), and the impact is only Low/Low confidentiality and integrity with no availability impact - this is not full remote code execution despite the 'RCE' tag. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a patch-this-cycle posture. On exploitation signals there is conflict/absence to note explicitly: the PoC is a WPScan reference only and is NOT verified as working exploit code, the CVE is NOT listed in CISA KEV, and no EPSS probability was provided in the input - so there is no evidence of active or widespread exploitation. The 'RCE' tag overstates impact relative to the CVSS C:L/I:L vector; treat this as a shortcode-abuse/injection flaw whose severity depends on which shortcodes are available on the target site.

An unauthenticated visitor submits a product/service review through the plugin's public review form, embedding a WordPress shortcode in a review field that the plugin fails to neutralise. When that review and field are displayed to other visitors or administrators, the injected shortcode is executed in the site context, abusing whatever shortcodes are registered on the site. A public PoC reference exists (WPScan) but it is not verified as working exploit code.