The WP Ultimate Review plugin for WordPress allows authenticated users with subscriber-level access or higher to supply a parameter that is passed directly to the do_shortcode function without adequate validation. This flaw enables the execution of any shortcode, which can be used to run arbitrary PHP code, modify site content, or perform other malicious actions on the host. The weakness corresponds to code injection (CWE‑94).

The vulnerability affects the WP Ultimate Review plugin developed by roxnor, any release up through version 2.4.2. WordPress sites that have this plugin installed and have at least a subscriber role are at risk.

The assessed CVSS score of 8.1 indicates a high severity risk. Because the EPSS score is not available, the current exploitation probability is unknown, but the exploit requires only that an attacker be logged in with subscriber privileges, a role commonly available on many WordPress installations. The vulnerability is not listed in the CISA KEV catalog, so no public exploit code is currently documented. Nevertheless, once authenticated, the attacker can embed dangerous shortcodes that may lead to code execution, defacement, or data exfiltration.