{
 "id": "WPSEC-2026-3095",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3095/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3095/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3095/index.md",
 "title": "Widgets for Amazon Reviews <= 14.3 - Unauthenticated Uncontrolled Resource Consumption via Online Visitor Counter",
 "description": "The Widgets for Amazon Reviews plugin for WordPress is vulnerable to Uncontrolled Resource Consumption via the online visitor counter endpoint in all versions up to, and including, 14.3, due to the plugin storing visitor data in a new 'ti-online-users-<page>' option for every page value it receives in the 'p' parameter. The plugin never deletes these options and does not limit how many it creates. This makes it possible for unauthenticated attackers to fill the options table with an unlimited number of rows, which degrades database performance and uses up disk space.",
 "plugin": {
  "slug": "review-widgets-for-amazon",
  "name": "Widgets for Amazon Reviews",
  "full_name": "Widgets for Amazon Reviews",
  "wordpress_org": "https://wordpress.org/plugins/review-widgets-for-amazon/",
  "advisories_url": "https://wpsec.com/vuln/plugin/review-widgets-for-amazon/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/review-widgets-for-amazon"
 },
 "type": "DOS",
 "cwe": [
  "CWE-770"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "13.2",
    "from_inclusive": true,
    "to": "15.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 13.2 before 15.0"
  ]
 },
 "introduced_in": "13.2",
 "fixed_in": "15.0",
 "remediation": "Update to 15.0 or later.",
 "fix_released": "2026-11-12T16:46:07+00:00",
 "published": "2026-11-13T17:41:06+00:00",
 "updated": "2026-11-13T15:55:17.091025+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3095/",
  "https://plugins.svn.wordpress.org/review-widgets-for-amazon/tags/15.0/",
  "https://wordpress.org/plugins/review-widgets-for-amazon/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/review-widgets-for-amazon",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-13"
 }
}