CVE-2026-92235 is a code injection vulnerability in the roxnor WP Ultimate Review WordPress plugin. The issue arises because the plugin improperly controls the generation of code by allowing arbitrary shortcode execution without proper validation. Authenticated attackers with subscriber-level privileges or above can exploit this to run arbitrary shortcodes, potentially leading to code execution within the WordPress context. The vulnerability affects all versions from 0 up to and including 2.4.2.

Successful exploitation allows an authenticated user with subscriber-level access or higher to execute arbitrary shortcodes, which can lead to unauthorized code execution affecting confidentiality and integrity of the WordPress site. Availability impact is not indicated. This could enable attackers to perform actions beyond their intended permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, restrict user roles and permissions to limit shortcode execution capabilities and monitor for unusual shortcode usage. Avoid granting subscriber-level or higher access to untrusted users until a fix is available.