{"id":"CVE-2026-101160","published":"2026-10-03T06:16:38.350","lastModified":"2026-10-06T15:18:12.170","description":"The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review rating is numeric before storing it and later using it in numeric operations when rendering reviews, allowing unauthenticated users to make the reviewed content fail with a fatal error for all visitors until the review is removed (a persistent denial of service), when user reviews are enabled.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-400"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/d728523f-1f33-470f-b64f-e9e286d29b6b/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The WP Ultimate Review plugin fails to validate review ratings as numeric values, allowing unauthenticated users to submit non-numeric ratings that cause fatal errors when rendering reviews, leading to persistent denial of service for all site visitors.","exploitability":"Easy to exploit with no preconditions; attackers can submit malformed review ratings via the public review submission endpoint to trigger fatal errors.","blast_radius":"High impact in real-world scenarios as the vulnerability affects all visitors until the problematic review is manually removed, potentially causing complete site unavailability for review-enabled sites.","remediation":"Upgrade to version 2.4.4 or later to fix the numeric validation issue in the WP Ultimate Review plugin.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["denial-of-service","wordpress","plugin"],"model":"garnet-coder","analyzedAt":"2026-10-12T09:01:49.335Z"}}