CVE-2026-101161CWE-400denial-of-service

CVE-2026-101161

High · published October 3, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
26.0
In the wild
Unconfirmed
What it is

The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visit, resulting in a persistent denial of service when the WP Ultimate Review WordPress plugin before 2.4.4's review display settings have never been saved.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00338 · 26.0th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-10-03T10:16Z
References (1)
https://wpscan.com/vulnerability/c1c3e2d7-4833-4e51-a3c7-45e6d036a525/ · [email protected]
EPSS history
Timeline
  • 04 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 03 OCT 06:00Z
    WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Unset Display Settings in wp-reviews Shortcode
    cvelistv5