Description

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-22T08:16:41.230Z",
  "pubdate": "2026-09-22T08:16:41.230Z",
  "executiveSummary": "The WP Ultimate Review plugin for WordPress, in versions up to and including 2.4.2, contains a critical vulnerability related to improper input validation, specifically leading to arbitrary shortcode execution.\nThis vulnerability is classified as an injection flaw. It allows authenticated attackers with subscriber-level privileges or higher to execute arbitrary shortcodes within the WordPress environment.\nThe primary risk implication is the potential for unauthorized privilege escalation, sensitive data exfiltration, or the triggering of malicious functionality hidden within other installed plugins or theme shortcodes.\nThe impact depends heavily on the presence of other vulnerable or functionality-rich shortcodes available on the target system. Because the vulnerability requires authentication, it is restricted to registered users; however, in many WordPress environments, open registration or low-privilege accounts can be easily obtained.\nNo external network exposure is required beyond the application's authentication portal, and exploitation does not require advanced technical skill once the injection vector is identified.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper sanitization and validation of user-supplied data that is subsequently passed into the WordPress `do_shortcode` function.\nIn versions 2.4.2 and earlier, the WP Ultimate Review plugin implements an action handler that accepts user input without verifying whether the provided data constitutes a malicious shortcode payload.\nThe WordPress `do_shortcode` function is designed to parse content for registered shortcode tags and execute the associated callback functions. When developers fail to restrict or sanitize the inputs processed by this function, they effectively grant authenticated users the ability to invoke any shortcode registered within the WordPress installation.\nThe attack flow proceeds as follows: First, an attacker authenticates to the WordPress instance using a subscriber-level account. Second, the attacker interacts with the vulnerable plugin endpoint, injecting a crafted shortcode sequence as the payload. Third, the plugin processes the request and improperly passes the unsanitized input to `do_shortcode`.\nBecause the payload is executed by the server-side WordPress core, the attacker can leverage the privileges of the web server user. This allows for the execution of administrative shortcodes if they are accessible, or the inclusion of sensitive files if the environment contains shortcodes that interact with the local filesystem.\nThe vulnerability is not restricted to the plugin's own shortcodes; it acts as a gateway to any shortcode defined by the active theme or other installed plugins. This expands the attack surface significantly, as an attacker could trigger administrative actions or bypass security checks if those features are exposed via shortcodes.\nThe lack of privilege-based access control (RBAC) on the affected action means that any authenticated user, regardless of their role, can trigger the execution. This represents a significant failure in the principle of least privilege, as subscribers should not have the capability to invoke functions that might influence global site behavior or process server-side logic."
}