Arbitrary Shortcode Execution in WP Ultimate Review Plugin for WordPress

CVE-2026-103519

What is CVE-2026-103519?

The WP Ultimate Review plugin, utilized widely in WordPress environments, has a vulnerability that permits arbitrary shortcode execution across all versions up to and including 2.4.3. This vulnerability arises from improper validation of user input, enabling authenticated users with subscriber-level access and higher to execute arbitrary shortcodes. The exploitation occurs when the plugin processes shortcodes without adequately checking the input, specifically through WordPress's strip_shortcodes() function. This flaw permits attackers to bypass security measures and execute potentially harmful code during post rendering.

References