Risk Profile
5.3
CVSS Score
Weakness
Missing Authorization
Researchers
hhhai
Vulnerability Report
Plugin
Medium
No patch listed
CVE-2026-39644
Ultimate Review <= 2.3.9 - Missing Authorization
The Ultimate Review plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.3.9. This makes it possible for unauthenticated attackers to perform an unauthorized action.
Quick Answer
CVE-2026-39644 is a medium severity with CVSS 5.3 Vulnerability issue affecting the Plugin WP Ultimate Review. It affects Versions up to 2.3.9 and is listed without a confirmed patched release.
Published
Feb 14, 2026
Last Updated
Apr 16, 2026
Slug
wp-ultimate-review
Patch Status
No patched release listed
Remediation
No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Operator Briefing
CVE-2026-39644 is tracked for the Plugin WP Ultimate Review as medium severity with CVSS 5.3. The affected range is Versions up to 2.3.9. No fixed release is listed in this feed entry, so operators should monitor the vendor and reference links before accepting the risk.
Issue Type
Vulnerability
Primary Fixed Version
Not published
Primary Affected Range
Versions up to 2.3.9
Tracking ID
CVE-2026-39644
Detailed Metadata
| Software Type | Plugin |
|---|---|
| Software Slug |
wp-ultimate-review
View on wordpress.org
|
| CVE | CVE-2026-39644 |
| Patched Versions |
No patched versions published.
|
| Affected Versions |
Versions up to 2.3.9
|
Related CVE Cluster
Related CVEs for WP Ultimate Review
These internal links group the same WordPress plugin by CVE, issue type, severity, and patch status so operators and search engines can connect the full vulnerability cluster.
Medium
CVE-2025-63057
2.3.8
Dec 07, 2025
CVE-2025-63057 WP Ultimate Review Stored Cross-Site Scripting
Ultimate Review <= 2.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-32683
2.3.0
Apr 17, 2024
CVE-2024-32683 WP Ultimate Review Authorization Bypass
Wp Ultimate Review <= 2.2.5 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2024-32684
2.3.0
Apr 17, 2024
CVE-2024-32684 WP Ultimate Review Vulnerability
Wp Ultimate Review <= 2.2.5 - Missing Authorization
Medium
CVE-2024-32685
2.3.0
Apr 17, 2024
CVE-2024-32685 WP Ultimate Review Vulnerability
Wp Ultimate Review <= 2.2.5 - Unauthenticated Review Restriction Bypass
Medium
CVE-2024-21746
2.3.7
Jan 05, 2024
CVE-2024-21746 WP Ultimate Review Vulnerability
Wp Ultimate Review <= 2.3.6 - IP Spoofing
Medium
CVE-2023-28751
2.1.0
Mar 29, 2023
CVE-2023-28751 WP Ultimate Review Stored Cross-Site Scripting
Wp Ultimate Review <= 2.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2023-46085
2.3.1
Oct 16, 2023
CVE-2023-46085 WP Ultimate Review Cross-Site Request Forgery
Wp Ultimate Review <= 2.3.0 - Cross-Site Request Forgery via wur_settings_view
Medium
CVE-2023-28987
2.1.0
Mar 29, 2023
CVE-2023-28987 WP Ultimate Review Cross-Site Request Forgery
Wp Ultimate Review <= 2.0.3 - Cross-Site Request Forgery
Licensing Notices
This record contains material that is subject to copyright
DEFIANT
Copyright 2012-2026 Defiant Inc.
License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more
MITRE
Copyright 1999-2026 The MITRE Corporation
License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more