WP TripAdvisor Review Slider CVE-2026-11969

Exploitation requires an authenticated WordPress user account holding the Administrator role (or a higher custom role with equivalent database-query capabilities). The attacker must submit the curselrevs[] POST parameter to the vulnerable admin-side endpoints defined in class-wp-tripadvisor-review-slider-admin.php (lines 599 and 671) and class-wp-tripadvisor-review-slider.php (line 285); these endpoints are only reachable by logged-in admin users. The WP TripAdvisor Review Slider plugin must be installed and active on the target WordPress site. Exploitation is further limited to read-only database access - the injection does not support write operations based on the I:N impact rating. The primary limiting factor is the administrator credential requirement: unauthenticated or subscriber/editor-level users cannot reach the vulnerable code paths.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N correctly reflects the core risk dynamic: while the network attack vector and low complexity suggest ease of execution, the PR:H (high privilege) requirement means an attacker must already hold WordPress administrator credentials. This is the dominant limiting factor - a credential-bearing administrator typically already has alternative means to access database content (WP export tools, phpMyAdmin, direct server access). The vulnerability is most relevant in multi-tenant hosting scenarios, insider threat situations, or cases where untrusted parties are granted WordPress admin roles. Impact is confined to confidentiality (C:H), with no integrity or availability effects, further constraining real-world damage potential. No EPSS score was provided in the available data, so exploitation probability cannot be quantified. The vulnerability is absent from CISA KEV, and no POC code is identified - these signals together support treating this as a low operational priority for most standard single-tenant WordPress deployments.

An attacker who has obtained WordPress administrator credentials - through phishing, credential stuffing, or insider access - authenticates to the WordPress admin panel and submits a crafted HTTP POST request to the plugin's admin endpoint with a malicious SQL payload embedded in the curselrevs[] array parameter. The unsanitized array values are appended to an existing SQL query in the plugin's admin class, allowing the attacker to exfiltrate arbitrary rows from the WordPress database, including the wp_users table containing hashed passwords and email addresses. No public exploit code has been identified, but the straightforward nature of array-based SQL injection makes manual exploitation achievable by any attacker with basic SQL knowledge and authenticated access.