WP Review Slider Pro EUVD-2026-37040

Requires (1) an authenticated WordPress session at Subscriber role or above on the target site - satisfied trivially where 'Anyone can register' is enabled, otherwise requiring credential theft or prior account compromise; (2) the WP Review Slider Pro plugin installed and active at version <= 12.6.8 so that the wpfb_find_reviews AJAX action is registered; and (3) network reachability to /wp-admin/admin-ajax.php. No user interaction by a victim is needed, no non-default plugin configuration is required, and exploitation is platform-agnostic across the LAMP/LEMP stacks WordPress runs on. The principal limiter is the Subscriber-or-above authentication gate; sites with registration disabled significantly raise the bar.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8 High) reflects that exploitation only requires a low-privilege WordPress account and a single crafted AJAX request - trivial on any site that allows self-registration (a common WordPress default). The C:H/I:H/A:H impacts are slightly aggressive for a SELECT-only IN-clause injection that primarily enables data exfiltration; integrity and availability impact via stacked queries is constrained by $wpdb->get_results which typically executes a single statement on MySQL, so realistic impact is closer to C:H/I:L/A:L unless the attacker chains into administrative takeover by reading password hashes or auth keys. No EPSS score, KEV listing, or POC was provided in the intelligence, and the only reference is the Wordfence threat-intel entry, so widespread automated exploitation is not yet evidenced - but the SQLi class is highly automatable once a researcher publishes payload details.

An attacker registers a free Subscriber-level account on a target WordPress site running WP Review Slider Pro <= 12.6.8, then sends a POST request to /wp-admin/admin-ajax.php with action=wpfb_find_reviews and a crafted curselrevs[] array element such as 0) UNION SELECT user_login,user_pass,3,4 FROM wp_users-- -. The injected payload is concatenated into the IN-clause and executed unprepared, returning password hashes and session-relevant secrets in the AJAX response, which the attacker uses to crack or escalate to administrator. No public exploit identified at time of analysis, but the bug pattern is straightforward to weaponize.