CVE-2026-101161

Summary

The WP Ultimate Review plugin has a vulnerability where unauthenticated users can inject crafted review content that causes fatal errors on every page visit, leading to persistent denial of service. This affects sites where review display settings have never been saved.

Exploitability

Exploitation is straightforward as it requires no authentication and only needs a user to submit a crafted review, with the precondition being that the plugin's review display settings have never been saved.

Blast radius

The impact could affect all visitors to affected pages, causing complete site unavailability until the issue is manually resolved by administrators.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 2.4.4 or later to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.