Denial-of-Service caused by uncontrolled resource usage (CWE-400). The WP Ultimate Review WordPress plugin stores review content without validating or sanitizing input from unauthenticated users. A crafted review can be saved when the plugin’s display settings have never been set, causing most pages that invoke the review shortcode to trigger a fatal error on every visit. The resulting error stops the page from rendering, effectively denying service to all visitors.

Any WordPress site that uses the WP Ultimate Review plugin and has a version earlier than 2.4.4 is affected. Sites that have not yet configured the review display settings are especially vulnerable because the stored content activates the fault on initial load.

The vulnerability is exploitable by anyone on the internet without needing to authenticate, acting through the standard review submission form. With a CVSS score of 7.5, the impact is a persistent denial of service that cannot be resolved without patching or disabling the plugin. The EPSS score of 0.00156 (< 1%) and the fact that the vulnerability is not listed in CISA KEV suggest that widespread exploitation has not yet been observed, but the logical simplicity of the attack means it could proliferate quickly.