CVE-2026-101160: WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Non-Numeric Review Rating

Q: Who is exposed to this issue?

Sites using WP Ultimate Review versions before 2.4.4 are exposed when user reviews are enabled. The attack can affect content that accepts reviews.

Q: What does an attacker need to exploit it?

An attacker does not need to authenticate. They need to submit a review with a non-numeric rating to content where user reviews are enabled.

Q: What happens after a malicious review is submitted?

When the affected reviewed content is rendered, the stored non-numeric rating can trigger a fatal error. Visitors may be unable to view that content until the malicious review is removed.

Q: What can be done if upgrading is not immediately possible?

Disable user reviews to prevent unauthenticated submission of malicious ratings, and remove any reviews containing non-numeric ratings. Upgrade to version 2.4.4 or later when possible.

Published Oct 3, 2026

Updated

The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review rating is numeric before storing it and later using it in numeric operations when rendering reviews, allowing unauthenticated users to make the reviewed content fail with a fatal error for all visitors until the review is removed (a persistent denial of service), when user reviews are enabled.

Affected Software

1 affected component

WP Ultimate Review WP Ultimate Review WordPress plugin<2.4.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WP Ultimate Review to a version that resolves this vulnerability.
Fixed in 2.4.4

Event History

Oct 3, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

Sites using WP Ultimate Review versions before 2.4.4 are exposed when user reviews are enabled. The attack can affect content that accepts reviews.

What does an attacker need to exploit it?

An attacker does not need to authenticate. They need to submit a review with a non-numeric rating to content where user reviews are enabled.

What happens after a malicious review is submitted?

When the affected reviewed content is rendered, the stored non-numeric rating can trigger a fatal error. Visitors may be unable to view that content until the malicious review is removed.

What can be done if upgrading is not immediately possible?

Disable user reviews to prevent unauthenticated submission of malicious ratings, and remove any reviews containing non-numeric ratings. Upgrade to version 2.4.4 or later when possible.

CVE-2026-101160: WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Non-Numeric Review Rating

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What happens after a malicious review is submitted?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What happens after a malicious review is submitted?

What can be done if upgrading is not immediately possible?