{"id":"CVE-2026-101161","published":"2026-10-03T06:16:38.590","lastModified":"2026-10-06T15:18:12.170","description":"The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visit, resulting in a persistent denial of service when the WP Ultimate Review WordPress plugin before 2.4.4's review display settings have never been saved.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-400"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/c1c3e2d7-4833-4e51-a3c7-45e6d036a525/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The WP Ultimate Review plugin has a vulnerability where unauthenticated users can inject crafted review content that causes fatal errors on every page visit, leading to persistent denial of service. This affects sites where review display settings have never been saved.","exploitability":"Exploitation is straightforward as it requires no authentication and only needs a user to submit a crafted review, with the precondition being that the plugin's review display settings have never been saved.","blast_radius":"The impact could affect all visitors to affected pages, causing complete site unavailability until the issue is manually resolved by administrators.","remediation":"Upgrade to version 2.4.4 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["dos","wordpress","plugin"],"model":"garnet-coder","analyzedAt":"2026-10-12T09:01:42.415Z"}}