CVE-2020-36726

CRITICAL

Ultimate Reviews <2.1.32 - Code Injection

Title source: llm

Description

The Ultimate Reviews plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.1.32 via deserialization of untrusted input in several vulnerable functions. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin.

References (3)

Scores

CVSS v3 9.8
EPSS 0.0096
EPSS Percentile 76.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE
CWE-502
Status published

Affected Products (1)

etoilewebdesign/ultimate_reviews < 2.1.32

Timeline

Published Jun 07, 2023
Tracked Since Feb 18, 2026