CVE-2026-24634
BaseFortify
Publication date: 2026-01-23
Last updated on: 2026-01-26
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| patchstack | ultimate_reviews | to 3.2.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-24634 is an Insecure Direct Object References (IDOR) vulnerability in the WordPress Ultimate Reviews Plugin (versions up to 3.2.16). It allows unauthenticated attackers to bypass authorization and authentication controls by exploiting incorrectly configured access control security levels, potentially granting unauthorized access to sensitive files, folders, or database interactions. [1]
How can this vulnerability impact me? :
This vulnerability can allow attackers to bypass access controls and gain unauthorized access to sensitive data or resources within the Ultimate Reviews plugin. Although the CVSS score is 5.3 indicating low impact and low likelihood of exploitation, it could still lead to exposure of sensitive information or unauthorized actions within the affected system. [1]
What immediate steps should I take to mitigate this vulnerability?
Since no official fix or patched version is currently available for this vulnerability, immediate mitigation steps include limiting access to the Ultimate Reviews plugin, monitoring for unauthorized access attempts, and using Patchstack's mitigation services if available. Additionally, consider restricting permissions and access controls on sensitive files and database interactions related to the plugin to reduce exposure. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.