CVE-2026-103519 roxnor CVE debrief

Who should care

Defenders responsible for WordPress installations with the WP Ultimate Review plugin, particularly those with subscriber-level and above user accounts, should assess exposure and prioritize verification and potential remediation.

Why it matters

CVE-2026-103519 allows authenticated attackers to execute arbitrary shortcodes in the WP Ultimate Review plugin for WordPress, potentially impacting content integrity or confidentiality.

• Authenticated attackers with subscriber-level access and above can execute arbitrary shortcodes
• Potential for lateral movement or escalation of privileges
• Possible impact on content integrity or confidentiality
• Verification of plugin version and user account exposure is necessary

Technical summary

The WP Ultimate Review plugin for WordPress allows authenticated attackers with subscriber-level access and above to execute arbitrary shortcodes due to improper validation of values before running do_shortcode. This makes it possible for attackers to potentially impact content integrity or confidentiality. Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assess the exposure of subscriber-level and above user accounts. The vulnerability affects all versions up to, and including, 2.4.3 of the plugin.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assess the exposure of subscriber-level and above user accounts.

Recommended defensive actions

• Verify the presence of WP Ultimate Review plugin version 2.4.3 or earlier in your WordPress installation
• Assess the exposure of subscriber-level and above user accounts
• Consider updating to a patched version of the plugin, if available
• Monitor for suspicious activity related to shortcode execution
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and references to source code. The WP Ultimate Review plugin for WordPress allows authenticated attackers with subscriber-level access and above to execute arbitrary shortcodes due to improper validation of values before running do_shortcode. Defenders should verify plugin version, assess exposure of subscriber-level user accounts, and monitor for suspicious activity. Evidence is limited to CVE and NVD details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.