The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review rating is numeric before storing it and later using… (CVE-2026-101160)
The WP Ultimate Review WordPress plugin versions before 2.4.4 contain a vulnerability where the plugin does not validate that a submitted review rating is numeric before storing and using it in numeric operations. This flaw allows unauthenticated users to submit non-numeric ratings, causing a fatal error that results in a persistent denial of service affecting all visitors until the problematic review is removed, provided that user reviews are enabled.
AI Analysis
Technical Summary
CVE-2026-101160 describes a vulnerability in the WP Ultimate Review WordPress plugin prior to version 2.4.4. The plugin fails to validate that review ratings submitted by users are numeric before storing them and performing numeric operations during review rendering. This lack of validation enables unauthenticated attackers to submit crafted non-numeric ratings that trigger fatal errors, causing the reviewed content to become inaccessible to all visitors until the offending review is deleted. This constitutes a persistent denial of service condition when user reviews are enabled.
Potential Impact
An unauthenticated attacker can cause a persistent denial of service on content that uses the WP Ultimate Review plugin by submitting a non-numeric review rating. This leads to fatal errors during review rendering, making the affected content unavailable to all visitors until the malicious review is removed. There is no indication of code execution or data disclosure from the provided information.
Mitigation Recommendations
A fix is available in WP Ultimate Review version 2.4.4 and later. Users should upgrade to version 2.4.4 or newer to resolve this vulnerability. Until the upgrade is applied, disabling user-submitted reviews can prevent exploitation. Removing any malicious non-numeric reviews will restore normal functionality.
The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review rating is numeric before storing it and later using… (CVE-2026-101160)
Description
The WP Ultimate Review WordPress plugin versions before 2.4.4 contain a vulnerability where the plugin does not validate that a submitted review rating is numeric before storing and using it in numeric operations. This flaw allows unauthenticated users to submit non-numeric ratings, causing a fatal error that results in a persistent denial of service affecting all visitors until the problematic review is removed, provided that user reviews are enabled.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-101160 describes a vulnerability in the WP Ultimate Review WordPress plugin prior to version 2.4.4. The plugin fails to validate that review ratings submitted by users are numeric before storing them and performing numeric operations during review rendering. This lack of validation enables unauthenticated attackers to submit crafted non-numeric ratings that trigger fatal errors, causing the reviewed content to become inaccessible to all visitors until the offending review is deleted. This constitutes a persistent denial of service condition when user reviews are enabled.
Potential Impact
An unauthenticated attacker can cause a persistent denial of service on content that uses the WP Ultimate Review plugin by submitting a non-numeric review rating. This leads to fatal errors during review rendering, making the affected content unavailable to all visitors until the malicious review is removed. There is no indication of code execution or data disclosure from the provided information.
Mitigation Recommendations
A fix is available in WP Ultimate Review version 2.4.4 and later. Users should upgrade to version 2.4.4 or newer to resolve this vulnerability. Until the upgrade is applied, disabling user-submitted reviews can prevent exploitation. Removing any malicious non-numeric reviews will restore normal functionality.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-4g77-2gv7-vccg
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-101160"]
- State
- PUBLISHED
Threat ID: 6ac13999a43b0b3b89d699cd
Added to database: 10/03/2026, 17:21:29 UTC
Last enriched: 10/03/2026, 17:35:23 UTC
Last updated: 10/04/2026, 02:46:02 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.