WP Review Slider Pro EUVD-2026-41274

Exploitation requires that the target WordPress site host a public frontend page rendering the WP Review Slider Pro shortcode, because that page is what exposes the check_ajax_referer nonce via wp_localize_script; with that nonce, the wp_ajax_nopriv_wprp_load_more_revs hook is reachable by unauthenticated visitors. Beyond obtaining the publicly-served nonce there are no privilege, authentication, or user-interaction prerequisites (PR:N/UI:N), and default configurations of vulnerable versions (up to and including 12.7.2) are affected. The primary limiting factor is that a site not displaying the plugin's shortcode on any public page will not leak the nonce; extraction is also read-only (confidentiality only) and blind/time-based, making data exfiltration slower and noisier than an inline error-based leak.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) is internally consistent with the description: network-reachable, low complexity, no privileges, no user interaction, high confidentiality impact, and no integrity or availability impact - appropriate for a read-only blind/time-based SQL injection that discloses data but does not modify it. The nopriv AJAX registration plus the publicly retrievable nonce genuinely remove the authentication barrier, so PR:N is justified rather than optimistic. No EPSS score, KEV listing, or POC was provided in the input, so real-world exploitation pressure cannot be quantified - this appears to be disclosed-but-not-yet-weaponized. Practical risk is tempered by prerequisites (a public page must render the plugin shortcode to expose the nonce) and by the read-only nature, but SQLi in WordPress plugins is a heavily automated attack class, so this should be treated as a genuine data-exposure priority for sites running the plugin rather than a high-CVSS/low-real-risk artifact.

An unauthenticated attacker browses to a public page that renders the WP Review Slider Pro shortcode, scrapes the wprp_load_more_revs nonce embedded by wp_localize_script, then POSTs a crafted numeric payload in the notinstring parameter to admin-ajax.php. Using blind/time-based boolean conditions they iteratively read sensitive data such as user credentials or secret keys from the WordPress database. No exploit code has been published at time of analysis, but the attack requires no authentication and only low complexity.