EUVD-2026-41274
GHSA-cmjq-cjh2-v8q8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network SQLi via a publicly leaked nonce gives AV:N/AC:L/PR:N/UI:N; read-only blind injection yields C:H with I:N/A:N.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' parameter of the wprp_load_more_revs AJAX action in versions up to, and including, 12.7.2. The parameter is read via $_POST['notinstring'] and passed through sanitize_text_field() - which strips HTML and whitespace but does not provide SQL safety. The value is then concatenated directly into a numeric/unquoted AND id NOT IN (...) clause and executed via $wpdb->get_results() without $wpdb->prepare() or intval() casting. Because the value sits in an unquoted numeric context, WordPress's wp_magic_quotes protection (which only escapes embedded quotes) is ineffective. The AJAX hook is registered via wp_ajax_nopriv_wprp_load_more_revs, and the required check_ajax_referer nonce is publicly available via wp_localize_script on any frontend page that renders the plugin shortcode, so an unauthenticated attacker who can reach a public page hosting the plugin can extract arbitrary data from the database via blind/time-based injection.
AnalysisAI
SQL injection in the WP Review Slider Pro WordPress plugin (versions up to and including 12.7.2) lets unauthenticated attackers extract arbitrary database contents through the 'notinstring' parameter of the wprp_load_more_revs AJAX action. Because the action is exposed via wp_ajax_nopriv and its required nonce is leaked to the frontend through wp_localize_script on any page rendering the plugin shortcode, anyone who can reach a public page hosting the plugin can exploit it. Reported by Wordfence with a CVSS of 7.5; no public exploit identified at time of analysis.
Technical ContextAI
This is a textbook CWE-89 SQL Injection in the plugin's 'load more reviews' AJAX handler. The value from $_POST['notinstring'] passes only through sanitize_text_field(), which strips HTML and trims whitespace but performs no SQL escaping, and is then concatenated directly into an unquoted numeric AND id NOT IN (...) clause and executed via $wpdb->get_results() without $wpdb->prepare() or intval() casting. Crucially, because the injection point is an unquoted numeric context, WordPress's wp_magic_quotes protection - which only escapes embedded quote characters - provides no defense, since a numeric injection needs no quotes to break out of the clause. The affected component is the WP Review Slider Pro plugin distributed via wpreviewslider.com (CPE cpe:2.3:a:https://wpreviewslider.com/:wp_review_slider_pro:*).
RemediationAI
No vendor-released patch version was identified in the available data, so administrators should consult the vendor change log at https://wpreviewslider.userecho.com/knowledge-bases/2/articles/88-change-log for a release later than 12.7.2 that fixes the wprp_load_more_revs handler and upgrade to it as the primary remediation, cross-checking against the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/396ba24f-e0f7-4374-a9ce-d9abddb87b39?source=cve. Until a fixed version is confirmed and applied, deploy a WAF rule (such as Wordfence) to filter SQL metacharacters and time-based injection patterns on the admin-ajax.php action=wprp_load_more_revs request and specifically on the notinstring parameter, accepting that WAF rules can be evaded and may need tuning. As a stronger compensating control, remove the plugin's shortcode from public pages or disable the 'load more reviews' feature, which stops the plugin from leaking the AJAX nonce and cuts off the unauthenticated path, at the cost of losing review pagination on those pages.
More in Wpreviewslider Com
View allAuthenticated SQL injection in the WP Review Slider Pro WordPress plugin through version 12.6.8 lets Subscriber-level us
SQL injection in the WP Review Slider Pro WordPress plugin (versions ≤12.6.8) allows authenticated attackers with Subscr
Arbitrary file deletion in the WP Review Slider Pro WordPress plugin (versions up to and including 12.6.8) allows authen
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today