EUVD-2026-37040
GHSA-42mq-4cj7-p7xm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable AJAX with Subscriber auth (PR:L), no UI; SELECT-only IN-clause injection yields high confidentiality but limited integrity/availability via $wpdb->get_results.
Primary rating from Vendor (Wordfence).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs[]' parameter of the wpfb_find_reviews AJAX action in versions up to, and including, 12.6.8. This is due to the handler reading $_POST['curselrevs'] raw with no sanitization or type casting, then concatenating each array element directly into a WHERE id IN ( ... ) clause without quoting and executing via $wpdb->get_results() without $wpdb->prepare(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
Authenticated SQL injection in the WP Review Slider Pro WordPress plugin through version 12.6.8 lets Subscriber-level users append arbitrary SQL via the wpfb_find_reviews AJAX action, enabling extraction of sensitive database contents including user credentials and secrets. The flaw is reachable by any logged-in WordPress account, which on sites with open registration effectively lowers the bar to near-unauthenticated. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Technical ContextAI
The vulnerability sits in the wpfb_find_reviews AJAX handler of WP Review Slider Pro, a commercial WordPress plugin (CPE cpe:2.3:a:https://wpreviewslider.com/:wp_review_slider_pro) used to display third-party review widgets. The handler reads $_POST['curselrevs'] as a raw array and concatenates each element directly into a WHERE id IN ( ... ) clause, then executes via $wpdb->get_results() without $wpdb->prepare(). This is a textbook CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the IN-list values are neither cast to integers nor quoted, so any array element can break out of the integer context and inject arbitrary SQL such as UNION SELECT statements against the wp_users or wp_options tables.
RemediationAI
No vendor-released patch version is identified in the provided intelligence; administrators should consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/633d26e9-8a05-4f4b-93a8-5644f2f699db?source=cve and the vendor site https://wpreviewslider.com/ for an updated release above 12.6.8 and upgrade immediately once available. Until a patched build is installed, deactivate the WP Review Slider Pro plugin or, at minimum, block POST requests to /wp-admin/admin-ajax.php with action=wpfb_find_reviews from non-administrator sessions via a WAF/ModSecurity rule (trade-off: any review-slider AJAX features will stop working). Also disable open user registration (Settings → General → uncheck 'Anyone can register') to remove the Subscriber-level prerequisite, and audit existing low-privilege accounts; this prevents the most realistic exploitation path but does not protect against an attacker who already controls a Subscriber account.
More in Wpreviewslider Com
View allSQL injection in the WP Review Slider Pro WordPress plugin (versions ≤12.6.8) allows authenticated attackers with Subscr
Arbitrary file deletion in the WP Review Slider Pro WordPress plugin (versions up to and including 12.6.8) allows authen
SQL injection in the WP Review Slider Pro WordPress plugin (versions up to and including 12.7.2) lets unauthenticated at
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today