Critical severity9.8NVD Advisory· Published Jun 7, 2023· Updated Apr 8, 2026

CVE-2020-36726

Description

The Ultimate Reviews plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.1.32 via deserialization of untrusted input in several vulnerable functions. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin.

Affected products

Etoilewebdesign/Ultimate Reviews
cpe:2.3:a:etoilewebdesign:ultimate_reviews:*:*:*:*:*:wordpress:*:*
Range: <=2.1.32
WordPress/Ultimate Reviewsllm-fuzzy
Range: <=2.1.32
Package: https://wordpress.org/plugins/ultimate-reviews

Patches

Vulnerability mechanics

References

blog.nintechnet.com/wordpress-ultimate-reviews-plugin-fixed-insecure-deserialization-vulnerability/nvdExploit
www.wordfence.com/threat-intel/vulnerabilities/id/db30acd7-ce51-45d9-8ff0-6ceea8237a8cnvdThird Party Advisory
plugins.trac.wordpress.org/changeset/2409141nvdRelease Notes

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000