EUVD-2026-44890
GHSA-3gw6-96rm-6cm8
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Administrator credential requirement (PR:H) is the binding constraint; network-reachable but read-only SQL exfiltration justifies C:H with I:N and A:N.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The WP TripAdvisor Review Slider plugin for WordPress is vulnerable to generic SQL Injection via the 'filtersource' parameter in all versions up to, and including, 14.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
SQL Injection in the WP TripAdvisor Review Slider WordPress plugin (all versions through 14.6) allows authenticated attackers holding administrator-level credentials to append arbitrary SQL to existing queries via the unsanitized 'filtersource' parameter, exposing sensitive data stored in the WordPress database. The flaw originates from insufficient escaping and missing prepared statement usage across multiple display and admin class files identified by Wordfence. No public exploit code or active exploitation has been identified at time of analysis, and the high privilege requirement significantly constrains real-world impact.
Technical ContextAI
The affected component is the WP TripAdvisor Review Slider plugin (CPE: cpe:2.3:a:jgwhite33:wp_tripadvisor_review_slider:*:*:*:*:*:*:*:*), a WordPress plugin for embedding TripAdvisor review widgets. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), manifesting in at least four source files: wp-tripadvisor-review-slider-public-display.php (lines 106 and 118), wp-tripadvisor-review-slider-public-display-widget.php (line 118), and class-wp-tripadvisor-review-slider-admin.php (line 3310). The 'filtersource' parameter is passed directly into SQL queries without proper escaping or use of WordPress's wpdb->prepare() pattern, making it injectable. This is a classic second-order or direct SQL injection pattern common in WordPress plugins that bypass the abstraction layer.
RemediationAI
Update the WP TripAdvisor Review Slider plugin to the version corresponding to changeset 3607754 or later via the WordPress plugin repository; the exact patched release version number is not independently confirmed from the available data, so administrators should check the plugin's changelog directly at https://plugins.trac.wordpress.org/changeset/3607754/wp-tripadvisor-review-slider to identify the target version and install it through the WordPress admin panel or WP-CLI. As a compensating control while patching is scheduled, restrict administrator-level access to the WordPress backend to trusted IP ranges using a web application firewall or server-level access controls - this directly addresses the PR:H prerequisite and eliminates the attack surface without disabling plugin functionality. Avoid granting administrator roles to untrusted users as a separate hygiene measure.
More in Wp Tripadvisor Review Slider
View allThe WP TripAdvisor Review Slider WordPress plugin before 10.8 does not properly sanitise and escape a parameter before u
The WP TripAdvisor Review Slider WordPress plugin before 11.9 does not sanitise and escape some of its settings, which c
A Stored Cross-Site Scripting (XSS) vulnerability exists in the WP TripAdvisor Review Slider WordPress plugin through ve
SQL injection in the WP TripAdvisor Review Slider WordPress plugin (all versions through 14.3) enables authenticated adm
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today