CVE-2026-101161: CWE-400 Uncontrolled Resource Consumption in WP Ultimate Review
The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visit, resulting in a persistent denial of service when the WP Ultimate Review WordPress plugin before 2.4.4's review display settings have never been saved.
AI Analysis
Technical Summary
CVE-2026-101161 describes an uncontrolled resource consumption vulnerability (CWE-400) in the WP Ultimate Review WordPress plugin versions prior to 2.4.4. The flaw permits unauthenticated users to store maliciously crafted review content that triggers a fatal error on the page displaying the review. This error recurs on every visit to the affected page, causing a persistent denial of service. The issue manifests only if the review display settings have never been saved, indicating a specific configuration dependency.
Potential Impact
The vulnerability leads to a persistent denial of service on pages displaying reviews, potentially disrupting website availability for visitors. Since the exploit requires no authentication, it can be triggered by any user, increasing the risk of exploitation. There is no indication of data leakage or privilege escalation from the provided information.
Mitigation Recommendations
Users of WP Ultimate Review should upgrade to version 2.4.4 or later where this vulnerability is fixed. No other mitigation or temporary workaround is indicated in the available data.
CVE-2026-101161: CWE-400 Uncontrolled Resource Consumption in WP Ultimate Review
Description
The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visit, resulting in a persistent denial of service when the WP Ultimate Review WordPress plugin before 2.4.4's review display settings have never been saved.
CVSS v3.1
Score 7.5high
Affected software
WP Ultimate Review
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-101161 describes an uncontrolled resource consumption vulnerability (CWE-400) in the WP Ultimate Review WordPress plugin versions prior to 2.4.4. The flaw permits unauthenticated users to store maliciously crafted review content that triggers a fatal error on the page displaying the review. This error recurs on every visit to the affected page, causing a persistent denial of service. The issue manifests only if the review display settings have never been saved, indicating a specific configuration dependency.
Potential Impact
The vulnerability leads to a persistent denial of service on pages displaying reviews, potentially disrupting website availability for visitors. Since the exploit requires no authentication, it can be triggered by any user, increasing the risk of exploitation. There is no indication of data leakage or privilege escalation from the provided information.
Mitigation Recommendations
Users of WP Ultimate Review should upgrade to version 2.4.4 or later where this vulnerability is fixed. No other mitigation or temporary workaround is indicated in the available data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-28T08:45:42.950Z
- State
- PUBLISHED
Threat ID: 6ac11721a43b0b3b89cacf5d
Added to database: 10/03/2026, 14:54:25 UTC
Last enriched: 10/03/2026, 14:55:57 UTC
Last updated: 10/04/2026, 04:45:56 UTC
Views: 14
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.