WP Ultimate Review (<= 2.4.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/wp-ultimate-review--2.4.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 22 Sep 2026 08:34:39 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgArbitrary Shortcode Execution in WP Ultimate Reviewhttps://feed.craftedsignal.io/briefs/2026-09-cve-2026-92235/Tue, 22 Sep 2026 08:34:39 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-cve-2026-92235/The WP Ultimate Review plugin for WordPress contains an arbitrary shortcode execution vulnerability (CVE-2026-92235) that allows authenticated attackers with subscriber-level access to execute arbitrary shortcodes.The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to and including 2.4.2. The flaw exists because the software fails to properly validate user-supplied input before passing it to the 'do_shortcode' function. An authenticated attacker with subscriber-level permissions or higher can exploit this lack of validation to trigger arbitrary shortcode execution. This vulnerability is significant as it allows low-privileged users to perform unauthorized actions or gain access to sensitive information typically restricted by the application, depending on the available shortcodes registered within the WordPress environment. Organizations using this plugin should evaluate their use of shortcodes and upgrade to a patched version once available.

Impact

Successful exploitation allows an authenticated subscriber to execute arbitrary shortcodes, potentially leading to unauthorized data disclosure, privilege escalation, or unauthorized modifications within the WordPress site depending on the installed plugins and theme capabilities.

Recommendation

  • Monitor WordPress administrative activity logs for unexpected shortcode usage by subscriber-level accounts.
  • Review the list of active plugins to identify those that register potentially sensitive or administrative shortcodes.
  • Update the WP Ultimate Review plugin to the latest version once a patch is released to remediate CVE-2026-92235.
  • Audit subscriber-level account permissions to ensure they are constrained from accessing sensitive plugin configurations.
]]>highadvisorywordpressvulnerabilityweb-application