CVE-2026-39644

MediumCVSS 5.3

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

Summary

The Wp Ultimate Review WordPress plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 2.3.8.

Risk Assessment

An attacker can add, edit, or delete reviews without proper permissions, potentially affecting site credibility and user trust.

Recommendation

Update the Wp Ultimate Review plugin to the latest version and review access control settings.

Original NVD description (English source)

Missing Authorization vulnerability in Roxnor Wp Ultimate Review wp-ultimate-review allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wp Ultimate Review: from n/a through <= 2.3.8.