CVE-2026-103234: WP Ultimate Review < 2.4.5 - Unauthenticated Arbitrary Shortcode Execution via Reviewer Email
The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortcodes in all of the review fields submitted through its public review form, which is available to unauthenticated visitors, allowing them to execute arbitrary shortcodes when the affected field is displayed, provided user reviews and that field's display are enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WP Ultimate Reviewto a version that resolves this vulnerability.Fixed in 2.4.5
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using WP Ultimate Review versions before 2.4.5 are exposed if user reviews are enabled and the affected review field is configured to be displayed. The public review form can be submitted by unauthenticated visitors.
What must an attacker do to exploit it?
An attacker needs to submit shortcode content through a review field that does not neutralise shortcodes. The shortcode is executed when that affected field is displayed.
Are default installations necessarily affected?
Not necessarily. Exploitation requires both user reviews and display of the affected field to be enabled.
How can I determine whether my site may be affected?
Check whether WP Ultimate Review is below version 2.4.5, whether its public review form accepts unauthenticated submissions, and whether review fields that accept submitted content are displayed.