The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the… (CVE-2026-101161)
The WP Ultimate Review WordPress plugin versions before 2.4.4 contain a vulnerability that allows unauthenticated users to store crafted review content. This crafted content causes the reviewed page to fail with a fatal error on every subsequent visit, resulting in a persistent denial of service. The issue occurs when the plugin's review display settings have never been saved.
AI Analysis
Technical Summary
The WP Ultimate Review WordPress plugin prior to version 2.4.4 does not properly restrict unauthenticated users from submitting specially crafted review content. This content triggers a fatal error on the reviewed page each time it is accessed, causing a persistent denial of service condition. The vulnerability specifically manifests if the review display settings have never been saved, allowing attackers to disrupt site availability persistently.
Potential Impact
An attacker can cause a persistent denial of service on pages using the WP Ultimate Review plugin by submitting crafted review content without authentication. This results in the reviewed page failing with a fatal error on every visit, potentially disrupting site functionality and user experience.
Mitigation Recommendations
Upgrade the WP Ultimate Review plugin to version 2.4.4 or later where this vulnerability is addressed. No other mitigation guidance is provided. Patch status is not explicitly confirmed, but the mention of 'before 2.4.4' implies that version 2.4.4 contains the fix.
The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the… (CVE-2026-101161)
Description
The WP Ultimate Review WordPress plugin versions before 2.4.4 contain a vulnerability that allows unauthenticated users to store crafted review content. This crafted content causes the reviewed page to fail with a fatal error on every subsequent visit, resulting in a persistent denial of service. The issue occurs when the plugin's review display settings have never been saved.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The WP Ultimate Review WordPress plugin prior to version 2.4.4 does not properly restrict unauthenticated users from submitting specially crafted review content. This content triggers a fatal error on the reviewed page each time it is accessed, causing a persistent denial of service condition. The vulnerability specifically manifests if the review display settings have never been saved, allowing attackers to disrupt site availability persistently.
Potential Impact
An attacker can cause a persistent denial of service on pages using the WP Ultimate Review plugin by submitting crafted review content without authentication. This results in the reviewed page failing with a fatal error on every visit, potentially disrupting site functionality and user experience.
Mitigation Recommendations
Upgrade the WP Ultimate Review plugin to version 2.4.4 or later where this vulnerability is addressed. No other mitigation guidance is provided. Patch status is not explicitly confirmed, but the mention of 'before 2.4.4' implies that version 2.4.4 contains the fix.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-7j5c-34gf-rc4m
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-101161"]
- State
- PUBLISHED
Threat ID: 6ac13997a43b0b3b89d699c5
Added to database: 10/03/2026, 17:21:27 UTC
Last enriched: 10/03/2026, 17:35:05 UTC
Last updated: 10/04/2026, 02:46:02 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.