WP Ultimate Review <= 2.4.3 - Unauthenticated Arbitrary Shortcode Execution via Review Submission
- ID
- WPSEC-2026-0045
- Plugin
- WP Ultimate Review (wp-ultimate-review)
- Affected
- all versions before 2.4.4
- Remediation
- Update to 2.4.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Weakness
- CWE-94
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- WP Ultimate Review on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-103519, on 2026-10-02.
Description
The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution via the public review submission form in all versions up to, and including, 2.4.3. This is due to an incomplete fix for CVE-2026-92235: version 2.4.3 passed the review summary, which is stored as the content of a publicly queryable review post, through strip_shortcodes() only. That single pass can be bypassed by splitting a shortcode name around another registered shortcode (the outer tag re-forms once the inner one is removed), and it does not remove shortcodes registered after the plugin's init handler runs. This makes it possible for unauthenticated attackers, when guest reviews are allowed (the default), to execute arbitrary shortcodes whenever the review post is viewed.
References
- https://wpsec.com/vuln/WPSEC-2026-0045/
- https://plugins.svn.wordpress.org/wp-ultimate-review/tags/2.4.4/
- https://wordpress.org/plugins/wp-ultimate-review/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS