The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. (CVE-2026-100157)
The WP Ultimate Review plugin for WordPress versions up to and including 2.4.3 contains a vulnerability that allows unauthenticated attackers to execute arbitrary shortcodes. This occurs because the plugin does not properly validate input before calling do_shortcode, and the nonce required for this action is publicly accessible. Submitted shortcode payloads are auto-published without admin approval by default, enabling exploitation without any user account or privileged interaction.
AI Analysis
Technical Summary
CVE-2026-100157 describes a vulnerability in the WP Ultimate Review WordPress plugin (<=2.4.3) where unauthenticated attackers can execute arbitrary shortcodes due to improper validation before do_shortcode execution. The nonce required to bypass the only security gate is publicly exposed via the review form, and the plugin auto-publishes submitted shortcodes without admin approval by default, allowing exploitation without authentication or privilege.
Potential Impact
An attacker can execute arbitrary shortcodes on a vulnerable WordPress site without authentication, potentially leading to limited confidentiality and integrity impacts. The CVSS score of 6.5 (medium severity) reflects that the vulnerability can be exploited remotely with no privileges or user interaction, but the impact on confidentiality and integrity is limited and there is no impact on availability.
Mitigation Recommendations
No official patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling the plugin or restricting access to the review form to trusted users. Review and adjust plugin settings to require admin approval for submitted content if possible.
The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. (CVE-2026-100157)
Description
The WP Ultimate Review plugin for WordPress versions up to and including 2.4.3 contains a vulnerability that allows unauthenticated attackers to execute arbitrary shortcodes. This occurs because the plugin does not properly validate input before calling do_shortcode, and the nonce required for this action is publicly accessible. Submitted shortcode payloads are auto-published without admin approval by default, enabling exploitation without any user account or privileged interaction.
CVSS v3.1
Score 6.5medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-100157 describes a vulnerability in the WP Ultimate Review WordPress plugin (<=2.4.3) where unauthenticated attackers can execute arbitrary shortcodes due to improper validation before do_shortcode execution. The nonce required to bypass the only security gate is publicly exposed via the review form, and the plugin auto-publishes submitted shortcodes without admin approval by default, allowing exploitation without authentication or privilege.
Potential Impact
An attacker can execute arbitrary shortcodes on a vulnerable WordPress site without authentication, potentially leading to limited confidentiality and integrity impacts. The CVSS score of 6.5 (medium severity) reflects that the vulnerability can be exploited remotely with no privileges or user interaction, but the impact on confidentiality and integrity is limited and there is no impact on availability.
Mitigation Recommendations
No official patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling the plugin or restricting access to the review form to trusted users. Review and adjust plugin settings to require admin approval for submitted content if possible.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-cpg8-jrv8-64x9
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-100157"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac13980a43b0b3b89d66f7b
Added to database: 10/03/2026, 17:21:04 UTC
Last enriched: 10/03/2026, 17:31:12 UTC
Last updated: 10/04/2026, 02:46:02 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.