WP Ultimate Review <= 2.4.3 - Unauthenticated Denial of Service via Review Rating
- ID
- WPSEC-2026-0047
- Plugin
- WP Ultimate Review (wp-ultimate-review)
- Affected
- all versions before 2.4.4
- Remediation
- Update to 2.4.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Weakness
- CWE-20
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- WP Ultimate Review on WPSec AttackSurface
- Fix released
- Published
Also published later by Another source as CVE-2026-101160, on 2026-10-01.
Description
The WP Ultimate Review plugin for WordPress is vulnerable to a persistent denial of service in all versions up to, and including, 2.4.3. This is due to the review submission handler only capping the submitted rating against the score limit, without checking that it is numeric, so a non-numeric value such as '-' is stored with the review. When the review list is rendered, the value is passed to round(), which throws a fatal TypeError on PHP 8 and later. This makes it possible for unauthenticated attackers, when guest reviews are allowed (the default) and reviews are published without approval, to make any post that shows reviews return a critical error to every visitor.
References
- https://wpsec.com/vuln/WPSEC-2026-0047/
- https://plugins.svn.wordpress.org/wp-ultimate-review/tags/2.4.4/
- https://wordpress.org/plugins/wp-ultimate-review/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS