Security Alert Summary
The WP Ultimate Review plugin for WordPress (versions up to and including 2.4.2) contains a vulnerability that allows authenticated users with subscriber-level access or higher to trigger arbitrary shortcode execution. The issue stems from insufficient validation before a call to do_shortcode, enabling execution of shortcodes that the site exposes.
CVE Details
- CVE ID: CVE-2026-92235
- Affected component: WP Ultimate Review plugin (vendor: roxnor)
- Affected versions: All versions up to and including 2.4.2
- Published: September 22, 2026 at 8:16:41 AM
- Last modified: September 22, 2026 at 11:17:26 AM
- CVSS v3.1 base score: 8.1
- CVSS v3.1 severity: HIGH
- CVSS v3.1 vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Authentication / privileges / user interaction: Requires authentication with low privileges (subscriber-level and above); no user interaction required
- Primary impact: Confidentiality: HIGH; Integrity: HIGH; Availability: NONE
- Weakness: CWE-94 (Improper Control of Generation of Code)
Technical Details
The vulnerability is an arbitrary shortcode execution issue. The plugin allows a user-supplied value to be passed to do_shortcode without appropriate validation. Because do_shortcode will process and execute any registered shortcode, an authenticated user with subscriber-level access or above can trigger execution of shortcodes available on the site.
The root cause is a missing validation step before calling do_shortcode; the software does not properly verify that the value to be executed is safe or originates from a trusted source. The description identifies the unvalidated action and the subsequent do_shortcode call as the trigger for the issue.
Impact is limited to what the site exposes via shortcodes. Depending on the shortcodes present, this may allow disclosure of data or modification of content exposed through shortcode handlers. The available information does not indicate an unauthenticated remote exploit vector or direct impact on availability.
How This Could Impact Your Website
Consider a small organization running WP Ultimate Review with several user roles: a site owner, an internal editor, and an external contractor who submits reviews. Because subscribers and higher can exploit this issue, an attacker who controls a contributor or contractor account could cause shortcodes to run that display internal data or change content rendered to visitors. This could, for example, reveal internal user information such as email addresses if a shortcode exposes that data, increasing the risk of targeted phishing or social engineering against staff listed on the site.
The issue does not by itself imply full site takeover, but it does raise the risk of information exposure and integrity issues for content produced via shortcode handlers. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, especially for contributors and other low-privilege accounts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and logs for unusual behavior related to shortcode usage or unexpected content output.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.2/app/content.php#L189
- https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.2/app/content.php#L341
- https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.2/app/content.php#L360
- https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.2/app/content.php#L56
- https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.2/init.php#L271
- https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.2/views/public/meta-box-user-review.php#L538
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3703958%40wp-ultimate-review&new=3703958%40wp-ultimate-review
- https://www.wordfence.com/threat-intel/vulnerabilities/id/dc0fe855-97b7-46ef-b1c8-1602447e97e6?source=cve
