CVE-2026-103519 in WP Ultimate Review Plugin
Summary
by MITRE • 10/03/2026
The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. The bypass relies on WordPress's own strip_shortcodes() function unwrapping the [[tag]] double-bracket escape to a bare [tag] that survives wp_insert_post storage and fires when the publicly queryable xs_review post type is rendered through the_content.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/03/2026
The WP Ultimate Review plugin for WordPress, specifically in versions up to 2.4.3, contains a critical vulnerability classified as arbitrary shortcode execution. This flaw stems from an insufficient validation mechanism within the software's handling of user-supplied input prior to processing shortcodes. The core technical issue arises when the application accepts data that is intended to be escaped or neutralized but fails to properly sanitize it before passing it through WordPress's do_shortcode function. This lack of rigorous input verification allows malicious actors to inject crafted shortcode payloads into the system, which are then executed with the privileges associated with the context in which they are rendered.
The exploitation vector for this vulnerability is particularly notable because it leverages a specific behavior within the WordPress core itself rather than relying solely on plugin logic errors. The attack relies on bypassing the strip_shortcodes function, which is designed to remove shortcodes from content by unwrapping double brackets [[tag]] into single brackets [tag]. In this scenario, an authenticated attacker with subscriber-level access or higher can input a shortcode wrapped in double brackets. When this data is stored via wp_insert_post, it undergoes processing that inadvertently strips one set of brackets but leaves the other intact due to how the storage and retrieval mechanisms interact with the escaping logic. Consequently, when the publicly queryable xs_review post type is rendered through the_content filter, the remaining single-bracket shortcode is interpreted as a valid command by do_shortcode rather than being treated as literal text or safely escaped content.
This vulnerability has significant operational implications for WordPress site administrators and users. Because it requires only subscriber-level access, which is often granted to casual visitors or low-privilege accounts on public-facing sites, the barrier to entry for exploitation is extremely low. An attacker does not need administrative privileges to execute arbitrary shortcodes; they merely need a basic account. Once executed, these shortcodes can perform any action that the shortcode author intended, ranging from displaying sensitive information and manipulating site content to executing more severe attacks if specific dangerous shortcodes are available on the target installation. This effectively allows low-privilege users to escalate their impact within the application environment, potentially leading to defacement, data leakage, or further compromise depending on the capabilities of the executed shortcodes.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection), specifically involving server-side code execution through improper validation of user input. It also maps to MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse, where an adversary uses built-in system tools or functions to execute commands without direct shell access. The specific mechanism of bypassing security controls via encoding or escaping manipulation is a common pattern in web application vulnerabilities, highlighting the risks associated with relying on default WordPress sanitization behaviors without additional plugin-level validation layers.
To mitigate this vulnerability, site administrators should immediately update WP Ultimate Review to version 2.4.4 or later, where the input validation logic has been corrected to prevent the bypass of strip_shortcodes and ensure that shortcodes are properly escaped before execution. For sites unable to update immediately due to compatibility concerns with other plugins, temporary mitigations include restricting user registration if not strictly necessary, implementing a Web Application Firewall (WAF) rule to block requests containing suspicious shortcode patterns in post content fields, or disabling the xs_review post type's public queryability until the patch is applied. Regular auditing of installed plugins and adherence to least-privilege principles for user accounts are also recommended practices to reduce the attack surface associated with such vulnerabilities.