rootpwn

medium · CVSS v3 6.5 · EPSS 0.0028

CVE-2026-100157

WP Ultimate Review plugin up to 2.4.3 allows unauthenticated users to execute arbitrary shortcodes via the public review form, enabling remo

Overview

WP Ultimate Review plugin up to 2.4.3 allows unauthenticated users to execute arbitrary shortcodes via the public review form, enabling remote code execution on the site. The vulnerability stems from improper nonce validation and auto-publishing of submitted shortcodes. This can compromise site integrity and availability.

Description

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The nonce required to pass the only gate is emitted to unauthenticated visitors via the public review form, and submitted shortcode payloads are auto-published without admin approval by default, meaning exploitation requires no account and no privileged interaction.

Impact

Confidentiality: attackers can read or exfiltrate site content. Integrity: malicious shortcodes can modify or delete content. Availability: site downtime or degraded performance. Defenders: WordPress site owners and administrators using the WP Ultimate Review plugin.

Remediation

Update the plugin to version 2.4.4 or later. If an update is not feasible, disable the review form or block shortcode execution by setting 'allow_shortcodes' to false. Ensure nonce validation is enforced and monitor for unexpected shortcode usage.

Risk context

Medium severity with a low EPSS score of 0.0028 indicates a moderate risk that is unlikely to be widely exploited, but timely patching is recommended to mitigate potential attacks.

Affected products

  • WordPress
  • WP Ultimate Review

Scores

Severity
medium
CVSS v2
6.4
CVSS v3
6.5
CVSS v4
—
EPSS
0.0028

wordpress plugin arbitrary-code-execution shortcode unauthenticated wp-ultimate-review

← All CVEs

Related CVEs

medium

CVE-2026-105144

A flaw has been found in Drogon up to 1.9.13-1/10.0-beta.3 on Windows. Affected is the function StaticFileRouter::route of the file lib/src/StaticFileRouter.cc of the component Static File Router. Executing a manipulation can lead to path traversal. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

medium

CVE-2026-105205

SiYuan versions prior to 3.8.5 allow publish‑mode readers to retrieve backlink block IDs and reference counts from password‑protected or publish‑disabled documents via API calls. This exposes hidden metadata that should remain confidential. The flaw is exploitable by sending POST requests to /api/block/getDocInfo or getDocsInfo for a published document ID.

View analysis

medium

CVE-2026-97927

The CVE-2026-97927 flaw in the Linux kernel’s UFS filesystem causes an oops during mount teardown when cylinder group reading fails, potentially crashing the kernel. It occurs only when a writable UFS image has a corrupted first cylinder group. The issue is mitigated by applying the kernel patch that reorders root dentry creation.

View analysis

medium

CVE-2026-105096

CVE-2026-105096 is an authorization bypass vulnerability in the Customer Profile API of Omega Solution CoinEx Crypto 2025. By manipulating the ID parameter in the /customer/ endpoint, an attacker can gain unauthorized access to customer data. The flaw is exploitable remotely and has been publicly disclosed.

View analysis