CVE-2026-101161 PUBLISHED

WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Unset Display Settings in wp-reviews Shortcode

Assigner: WPScan
Reserved: 28.09.2026 Published: 03.10.2026 Updated: 03.10.2026

The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visit, resulting in a persistent denial of service when the WP Ultimate Review WordPress plugin before 2.4.4's review display settings have never been saved.

Product Status

Vendor Unknown
Product WP Ultimate Review
Versions Default: unaffected
  • affected from 0 to 2.4.4 (excl.)

Credits

  • Alban Roche finder
  • WPScan coordinator

References

Problem Types

  • CWE-400 Uncontrolled Resource Consumption CWE