WP TripAdvisor Review Slider CVE-2026-15651

Exploitation requires a valid WordPress account with administrator-level role or higher - this is the primary limiting factor and is confirmed by the CVSS PR:H metric. The 'filtersource' parameter must be reachable, meaning the WP TripAdvisor Review Slider plugin must be installed and active on the target WordPress site. No special non-default configuration is required beyond the plugin being present. What limits exploitation: the attacker must first obtain administrator credentials through a separate attack; no unauthenticated or subscriber/contributor-level path exists based on the description and CVSS vector. Exploitation is constrained to confidentiality (read-only data exfiltration from the database) - there is no integrity or availability impact.

Real-world risk is moderate-to-low despite the C:H confidentiality impact rating. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) accurately reflects that network reachability is trivial but exploitation is gated behind administrator-level WordPress credentials. An attacker who already holds admin access to a WordPress installation has numerous other avenues to extract database contents (e.g., theme/plugin editors, phpMyAdmin access, direct wp-config.php exposure), so the marginal risk added by this SQLi is limited. No EPSS score was provided in the intelligence, KEV status is not confirmed, and no public proof-of-concept has been identified. The changeset reference (3607754) in the WordPress plugin repository indicates a patch has been committed upstream. Overall, this is a genuine vulnerability but a low-urgency remediation item for most organizations due to the PR:H constraint.

An attacker who has obtained WordPress administrator credentials (whether through phishing, credential stuffing, or a separate compromise) navigates to a page or widget rendering TripAdvisor reviews and submits a crafted value in the 'filtersource' parameter appending malicious SQL. The injected clause causes the database to return additional rows containing sensitive WordPress data such as password hashes, API keys, or user email addresses. No public proof-of-concept code has been identified at time of analysis.