CVE-2026-101160
7.5 HIGHPublished 2026-10-03 · Updated 2026-10-06
AI risk analysis
- Summary
- The WP Ultimate Review plugin fails to validate review ratings as numeric values, allowing unauthenticated users to submit non-numeric ratings that cause fatal errors when rendering reviews, leading to persistent denial of service for all site visitors.
- Exploitability
- Easy to exploit with no preconditions; attackers can submit malformed review ratings via the public review submission endpoint to trigger fatal errors.
- Blast radius
- High impact in real-world scenarios as the vulnerability affects all visitors until the problematic review is manually removed, potentially causing complete site unavailability for review-enabled sites.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to version 2.4.4 or later to fix the numeric validation issue in the WP Ultimate Review plugin.
Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review rating is numeric before storing it and later using it in numeric operations when rendering reviews, allowing unauthenticated users to make the reviewed content fail with a fatal error for all visitors until the review is removed (a persistent denial of service), when user reviews are enabled.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-101161
- HIGHCVE-2026-14854
- HIGHCVE-2014-125130PoC
- HIGHCVE-2026-101159
- HIGHCVE-2026-103305
- HIGHCVE-2026-103309
- HIGHCVE-2026-104405
- HIGHCVE-2026-104725PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.