What is the CVSS score of CVE-2026-66658?

CVE-2026-66658 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of Reviewer Plugin are affected by CVE-2026-66658?

A SQL injection vulnerability in the Reviewer WordPress plugin (versions 3.14.2 and earlier) allows authenticated subscriber-level users to directly access and extract data from the entire WordPress…

How to fix or mitigate CVE-2026-66658?

Within 24 hours, inventory WordPress installations to identify if the Reviewer plugin version 3.14.2 or earlier is deployed and immediately disable the plugin pending further assessment. Within 7 days, determine whether this plugin provides essential functionality; if not, remove it entirely; if operationally required, implement database-level access controls restricting subscriber role permissions to exclude critical tables (wp_users, wp_options, wp_postmeta). Within 30 days, establish a monitoring schedule with Patchstack and the plugin vendor for security patch availability, prepare a testing and deployment plan for any released patch, and evaluate alternative plugins with equivalent features as a longer-term replacement strategy.

Reviewer Plugin CVE-2026-66658

EUVD-2026-57897 HIGH

SQL Injection (CWE-89)

2026-08-13 Patchstack

GHSA-vwxj-24jr-658r

WordPress SQLi Wordpress Plugin Reviewer Mvpthemes

8.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.5 HIGH

Network-accessible subscriber-authenticated SQLi (PR:L, AV:N, AC:L); scope change reflects cross-table DB read; no integrity impact observed; low availability impact from resource-intensive queries.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:27 vuln.today

CVE Published

Aug 13, 2026 - 13:37 cve.org

HIGH 8.5

DescriptionCVE.org

Subscriber SQL Injection in Reviewer <= 3.14.2 versions.

AnalysisAI

SQL injection in the Reviewer WordPress plugin (versions ≤ 3.14.2) by mvpthemes allows any authenticated subscriber-level user to query the underlying WordPress database over the network without user interaction. The changed scope (S:C) in the CVSS vector indicates that successful exploitation can reach data beyond the plugin's own tables, yielding high confidentiality impact against potentially the full WordPress database. Reported by Patchstack; no public exploit or CISA KEV listing is identified at time of analysis.

Technical ContextAI

CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) indicates the Reviewer plugin fails to adequately sanitize or parameterize user-supplied input before incorporating it into database queries. The affected product is identified by CPE cpe:2.3:a:mvpthemes:reviewer:*:*:*:*:*:*:*:*, confirming all versions through 3.14.2 are in scope. The Reviewer plugin is a WordPress add-on by mvpthemes providing review and rating functionality; its subscriber-accessible endpoints expose SQL query construction logic to low-privileged authenticated users. The CVSS scope change metric (S:C) suggests the injectable query context can traverse beyond the plugin's own data boundary, reaching shared WordPress database tables such as wp_users, wp_usermeta, or other plugin tables.

RemediationAI

Update the Reviewer plugin to the version confirmed as patched in the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/reviewer/vulnerability/wordpress-reviewer-plugin-3-14-2-sql-injection-vulnerability - no exact patched version number is independently confirmed in the available data, so the advisory and the official WordPress plugin repository should be consulted before upgrading. If an immediate update is not feasible, disable the Reviewer plugin entirely until patching is possible, which eliminates the attack surface at the cost of losing review and rating functionality. As an additional compensating control, disable open user registration (WordPress Admin > Settings > General > uncheck 'Anyone can register') to prevent external actors from self-provisioning subscriber accounts; note this does not protect against attacks from existing registered users. Database activity monitoring or a WordPress-specific WAF rule targeting SQLi patterns in Reviewer plugin endpoints may provide partial detection coverage but should not substitute for patching.