What is the CVSS score of CVE-2026-8441?

CVE-2026-8441 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of WP Review Slider Pro are affected by CVE-2026-8441?

WP Review Slider Pro WordPress plugin (versions ≤12.7.2) contains an unauthenticated SQL injection vulnerability with no public exploit identified at time of analysis.

How to fix or mitigate CVE-2026-8441?

Within 24 hours: scan all WordPress installations for WP Review Slider Pro v12.7.2 or earlier; deactivate and remove the plugin via WordPress admin or file system deletion. Within 7 days: if business requirements prevent removal, deploy Web Application Firewall rules blocking SQL injection patterns targeting wp-admin/admin-ajax.php endpoints; restrict AJAX access via network firewall to trusted sources. Within 30 days: monitor plugin vendor repository and Wordfence security advisories for patched versions; evaluate replacement review slider plugins.

WP Review Slider Pro CVE-2026-8441

EUVD-2026-41274 HIGH

SQL Injection (CWE-89)

2026-07-02 Wordfence

GHSA-cmjq-cjh2-v8q8

WordPress SQLi Wpreviewslider Com Https

7.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network SQLi via a publicly leaked nonce gives AV:N/AC:L/PR:N/UI:N; read-only blind injection yields C:H with I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 10:17 vuln.today

CVE Published

Jul 02, 2026 - 09:32 cve.org

HIGH 7.5

DescriptionCVE.org

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' parameter of the wprp_load_more_revs AJAX action in versions up to, and including, 12.7.2. The parameter is read via $_POST['notinstring'] and passed through sanitize_text_field() - which strips HTML and whitespace but does not provide SQL safety. The value is then concatenated directly into a numeric/unquoted AND id NOT IN (...) clause and executed via $wpdb->get_results() without $wpdb->prepare() or intval() casting. Because the value sits in an unquoted numeric context, WordPress's wp_magic_quotes protection (which only escapes embedded quotes) is ineffective. The AJAX hook is registered via wp_ajax_nopriv_wprp_load_more_revs, and the required check_ajax_referer nonce is publicly available via wp_localize_script on any frontend page that renders the plugin shortcode, so an unauthenticated attacker who can reach a public page hosting the plugin can extract arbitrary data from the database via blind/time-based injection.

AnalysisAI

SQL injection in the WP Review Slider Pro WordPress plugin (versions up to and including 12.7.2) lets unauthenticated attackers extract arbitrary database contents through the 'notinstring' parameter of the wprp_load_more_revs AJAX action. Because the action is exposed via wp_ajax_nopriv and its required nonce is leaked to the frontend through wp_localize_script on any page rendering the plugin shortcode, anyone who can reach a public page hosting the plugin can exploit it. Reported by Wordfence with a CVSS of 7.5; no public exploit identified at time of analysis.

Technical ContextAI

This is a textbook CWE-89 SQL Injection in the plugin's 'load more reviews' AJAX handler. The value from $_POST['notinstring'] passes only through sanitize_text_field(), which strips HTML and trims whitespace but performs no SQL escaping, and is then concatenated directly into an unquoted numeric AND id NOT IN (...) clause and executed via $wpdb->get_results() without $wpdb->prepare() or intval() casting. Crucially, because the injection point is an unquoted numeric context, WordPress's wp_magic_quotes protection - which only escapes embedded quote characters - provides no defense, since a numeric injection needs no quotes to break out of the clause. The affected component is the WP Review Slider Pro plugin distributed via wpreviewslider.com (CPE cpe:2.3:a:https://wpreviewslider.com/:wp_review_slider_pro:*).

RemediationAI

No vendor-released patch version was identified in the available data, so administrators should consult the vendor change log at https://wpreviewslider.userecho.com/knowledge-bases/2/articles/88-change-log for a release later than 12.7.2 that fixes the wprp_load_more_revs handler and upgrade to it as the primary remediation, cross-checking against the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/396ba24f-e0f7-4374-a9ce-d9abddb87b39?source=cve. Until a fixed version is confirmed and applied, deploy a WAF rule (such as Wordfence) to filter SQL metacharacters and time-based injection patterns on the admin-ajax.php action=wprp_load_more_revs request and specifically on the notinstring parameter, accepting that WAF rules can be evaded and may need tuning. As a stronger compensating control, remove the plugin's shortcode from public pages or disable the 'load more reviews' feature, which stops the plugin from leaking the AJAX nonce and cuts off the unauthenticated path, at the cost of losing review pagination on those pages.