CVE-2026-92235 Overview
CVE-2026-92235 is an arbitrary shortcode execution vulnerability in the WP Ultimate Review plugin for WordPress. The flaw affects all versions up to and including 2.4.2. Authenticated users with subscriber-level access or higher can execute arbitrary shortcodes because the plugin fails to validate input before passing it to WordPress do_shortcode. This allows low-privileged accounts to invoke shortcodes registered by other plugins or the theme, potentially exposing sensitive data or triggering unintended actions. The issue is tracked as an improper control of code generation weakness [CWE-94].
Critical Impact
Subscriber-level accounts can execute arbitrary shortcodes registered anywhere on the WordPress site, enabling information disclosure, content manipulation, and abuse of third-party plugin functionality.
Affected Products
- WP Ultimate Review plugin for WordPress
- All versions up to and including 2.4.2
- WordPress sites permitting subscriber-level registration with this plugin active
Discovery Timeline
- 2026-09-22 - CVE-2026-92235 published to NVD
- 2026-09-22 - Last updated in NVD database
Technical Details for CVE-2026-92235
Vulnerability Analysis
The WP Ultimate Review plugin exposes an action handler that forwards user-controlled input to the WordPress do_shortcode function without validating whether the value is an allowed shortcode. WordPress shortcodes execute PHP callbacks registered by the core, active themes, and other installed plugins. When arbitrary input is processed by do_shortcode, an attacker can invoke any registered shortcode on the site.
Exploitation requires authentication at subscriber level or above, a permission tier that WordPress sites frequently grant through open registration. The attack occurs over the network with low complexity and no user interaction, and it impacts both confidentiality and integrity.
Root Cause
The underlying flaw is missing input validation in a handler that ultimately calls do_shortcode. According to the referenced source, code paths in app/content.php, init.php, and views/public/meta-box-user-review.php in the 2.4.2 release accept caller-supplied values and dispatch them through the shortcode parser. Because the plugin does not restrict the input to a fixed allowlist of its own shortcodes, any registered shortcode tag becomes reachable.
Attack Vector
An authenticated attacker submits a request to the vulnerable plugin action containing arbitrary shortcode markup. WordPress then executes the shortcode server-side with the plugin's privileges, returning any output to the attacker or writing it into rendered content. This can be leveraged to enumerate protected data, invoke administrative shortcodes exposed by other plugins, or execute chained actions that abuse trusted callbacks.
Refer to the Wordfence Vulnerability Report and the WordPress Plugin Changeset for the affected code paths and remediation diff.
Detection Methods for CVE-2026-92235
Indicators of Compromise
- Requests from subscriber-level accounts to WP Ultimate Review AJAX or admin-post actions containing shortcode syntax such as [ and ] in unexpected parameters.
- Unexpected creation of subscriber accounts followed shortly by POST requests to WP Ultimate Review endpoints.
- Web server logs showing responses containing shortcode output rendered from parameters attackers control.
Detection Strategies
- Inspect PHP request logs for parameters submitted to WP Ultimate Review handlers containing shortcode brackets or names of shortcodes registered by other plugins.
- Baseline the plugin's normal request patterns and alert on subscribers invoking review-related actions with atypical payload structures.
- Correlate authenticated low-privilege sessions with subsequent access to sensitive shortcode-generated content.
Monitoring Recommendations
- Enable WordPress debug logging or a WAF request-body capture to preserve full parameter contents for post-incident review.
- Monitor the WP Ultimate Review plugin version reported by site inventory tools and alert on any host still running 2.4.2 or earlier.
- Track outbound HTTP calls initiated by PHP workers that follow shortcode processing, which can indicate abuse of third-party shortcode callbacks.
How to Mitigate CVE-2026-92235
Immediate Actions Required
- Update the WP Ultimate Review plugin to a version newer than 2.4.2 as soon as the vendor publishes a fixed release.
- Disable the plugin on sites where an upgraded version is not yet available and the site accepts open subscriber registration.
- Audit existing subscriber accounts for suspicious activity and remove accounts that show signs of automated creation.
Patch Information
The vendor commit referenced by the WordPress Plugin Changeset addresses the input handling in the affected files. Site owners should apply the fixed version through the WordPress plugin updater and confirm the installed version reports higher than 2.4.2 after the update.
Workarounds
- Restrict WordPress registration so subscriber accounts cannot be created by anonymous visitors until patching is complete.
- Deploy WAF rules that block requests to WP Ultimate Review action endpoints containing [ or ] characters in unexpected parameters.
- Temporarily remove or rename the plugin directory under wp-content/plugins/wp-ultimate-review/ on high-risk sites.
# Disable open registration until the plugin is patched
wp option update users_can_register 0
# Confirm the installed plugin version
wp plugin get wp-ultimate-review --field=version
# Deactivate the plugin if a fixed release is not yet available
wp plugin deactivate wp-ultimate-review
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
