CVE-2026-8441: WP Review Slider Pro SQL Injection Vulnerability

Technical summary

CVE-2026-8441 is a blind/time-based SQL injection in WP Review Slider Pro versions up to 12.7.2. The wprp_load_more_revs AJAX action (registered via wp_ajax_nopriv_) processes the 'notinstring' parameter from POST requests. The code applies sanitize_text_field() for HTML stripping but concatenates the unsanitized value directly into an unquoted numeric context within an AND id NOT IN(...) SQL clause. The statement is executed via $wpdb->get_results() without prepared statements or type casting. WordPress's wp_magic_quotes protection is bypassed because the injection point is numeric and unquoted, allowing SQL operators to execute. The public nonce availability via wp_localize_script on shortcode-rendered pages eliminates authentication barriers.

Business impact

This vulnerability enables unauthorized database reconnaissance and data exfiltration. An attacker can systematically extract sensitive information—user credentials, email addresses, private reviews, configuration data, or custom post types—depending on database structure and plugin configuration. For e-commerce or review-dependent sites, competitive intelligence theft or customer data harvesting is possible. Remediation delays increase dwell time and exposure window during active exploitation.

Affected systems

WP Review Slider Pro plugin versions up to and including 12.7.2 are affected. Impact scope includes any WordPress installation with this plugin active on public-facing pages that render the plugin's shortcode. Unauthenticated remote attackers can exploit this without user interaction or privilege escalation.

Exploitability

Exploitation is straightforward: the AJAX endpoint is unauthenticated, the nonce is publicly disclosed via inline JavaScript, and SQL injection syntax is injectable through the 'notinstring' parameter. Time-based techniques (SLEEP, BENCHMARK) enable data exfiltration even without direct result visibility. No special tools or credentials required—curl or similar HTTP clients suffice. The attack can be automated and scaled across multiple installations.

Remediation

Upgrade WP Review Slider Pro to a patched version beyond 12.7.2 (verify against the vendor's official advisory for the exact version containing the fix). The patch should implement $wpdb->prepare() with parameterized queries or intval() type casting on the 'notinstring' parameter to prevent SQL injection. Until patching is possible, disable the plugin or restrict AJAX endpoint access via web application firewall rules targeting wprp_load_more_revs requests from untrusted sources.

Patch guidance

1. Log into your WordPress admin dashboard and navigate to Plugins > Installed Plugins. 2. Check WP Review Slider Pro's current version (displayed on the plugin listing). 3. If version is 12.7.2 or earlier, update immediately by clicking 'Update Now' or visiting the WordPress Plugin Repository. 4. Verify the new version number post-update to confirm successful installation. 5. Test the review slider functionality on your site to ensure no regression. 6. Review your site's access logs for suspicious AJAX activity targeting wprp_load_more_revs prior to patching to identify potential exploitation attempts.

Detection guidance

Monitor web server and WordPress logs for POST requests to /wp-admin/admin-ajax.php with action=wprp_load_more_revs. Look for 'notinstring' parameters containing SQL keywords (UNION, SELECT, SLEEP, BENCHMARK, OR, AND) or non-numeric characters (quotes, parentheses, operators). Implement WAF rules to block payloads matching SQL injection patterns in this parameter. Consider disabling the wp_ajax_nopriv hook if the feature is not required on your site. Database query logging can reveal injected SQL statements executed via blind techniques.

Why prioritize this

This vulnerability scores HIGH (CVSS 7.5) due to unauthenticated remote access (AV:N, PR:N, UI:N) and high confidentiality impact (C:H). The attack surface is large—any public WordPress site running the plugin is at risk—and exploitation is trivial. Although integrity and availability are not directly compromised, the data exfiltration risk justifies immediate patching. Sites handling user data, reviews, or transactional information should prioritize this as critical.

Risk score, explained

CVSS 3.1 score of 7.5 (HIGH) reflects: Attack Vector: Network (AV:N)—remotely exploitable with no special network access; Attack Complexity: Low (AC:L)—no special conditions required; Privileges Required: None (PR:N)—unauthenticated exploitation; User Interaction: None (UI:N)—no social engineering or user action needed; Confidentiality: High (C:H)—full database read capability; Integrity: None (I:N)—no modification of data; Availability: None (A:N)—no denial of service component. The score reflects a serious information disclosure risk suitable for immediate remediation.

Frequently asked questions