CVE-2026-8444: WP Review Slider Pro SQL Injection Vulnerability – Critical Database Data Risk

Technical summary

CVE-2026-8444 is a SQL injection flaw in WP Review Slider Pro versions up to 12.6.8, affecting the wpfb_find_reviews AJAX action handler. The vulnerability stems from direct concatenation of unsanitized $_POST['curselrevs'] array elements into a WHERE id IN() SQL clause, executed via $wpdb->get_results() without parameterized query preparation via $wpdb->prepare(). Authenticated attackers (Subscriber role and above) can break out of the intended IN clause and append arbitrary SQL statements, enabling data exfiltration. The CVSS 3.1 score of 8.8 (HIGH) reflects the network-accessible attack vector, low complexity, low privilege requirement, and high impact on confidentiality, integrity, and availability.

Business impact

This vulnerability poses a direct threat to WordPress sites running WP Review Slider Pro, particularly those with user registration or multi-author content. Attackers can systematically extract sensitive information from the database—including user credentials, personal data, post content, and plugin configurations. For SaaS or content platforms, this could lead to regulatory violations (GDPR, CCPA), reputational damage, and loss of customer trust. The low privilege requirement means even compromised or malicious subscriber accounts pose a significant risk.

Affected systems

WP Review Slider Pro plugin versions up to and including 12.6.8 are vulnerable. Any WordPress installation running this plugin with the affected version range is at risk, particularly those with open user registration or multiple subscriber-level contributors. The vulnerability is only exploitable by authenticated users, so sites with restricted access may face reduced but non-zero risk.

Exploitability

Exploitation requires valid WordPress credentials at Subscriber level or higher, but these are often widely distributed on multi-author sites or easily obtained through social engineering. The attack is straightforward to execute—no special tools or complex crafting required, only parameter manipulation in an AJAX request. The lack of complexity, combined with easy authentication mechanisms, makes this a relatively low-friction attack for insiders or users with valid (but compromised) credentials. Public exploit code or proof-of-concept documentation would significantly accelerate widespread attacks.

Remediation

Update WP Review Slider Pro to a patched version beyond 12.6.8 as soon as it becomes available. Until patching, disable the wpfb_find_reviews AJAX action or restrict access to trusted roles via a security plugin. Additionally, implement database-level access controls and monitor for suspicious SQL patterns in query logs. Consider enforcing stronger authentication (MFA) to reduce the risk of unauthorized subscriber-level account access.

Patch guidance

Monitor the WP Review Slider Pro plugin repository and official vendor communications for version releases addressing this vulnerability. Apply patches immediately upon availability, testing in a staging environment first to ensure compatibility with your site's configuration and other active plugins. Set up automatic plugin updates if your site infrastructure allows, or establish a regular patching schedule to stay current with security releases.

Detection guidance

Monitor WordPress error logs and database query logs for SQL syntax errors or unusual query patterns in the wpfb_find_reviews AJAX handler output. Web application firewalls (WAF) should flag POST requests to wp-admin/admin-ajax.php with action=wpfb_find_reviews containing SQL keywords (UNION, SELECT, WHERE, OR, --) in the curselrevs parameter. Audit database access logs for queries executed by the WordPress user account that deviate from expected patterns. Review subscriber and above user accounts for suspicious activity during the vulnerability window.

Why prioritize this

With a CVSS score of 8.8 and confirmed SQL injection capability, this vulnerability should be prioritized for immediate patching. The low privilege barrier (Subscriber access is often granted liberally) and high impact on data confidentiality create substantial risk. Organizations should treat this as urgent unless the plugin is unused or access is comprehensively restricted.

Risk score, explained

The score of 8.8 reflects a high-severity network-accessible SQL injection requiring only authenticated access. The attack vector is direct (HTTP/AJAX), exploitation is straightforward (no special conditions beyond authentication), and impact spans confidentiality, integrity, and availability of database contents. The only mitigating factor is the authentication requirement, but Subscriber-level credentials are often abundant or easily obtained, reducing the practical barrier to exploitation.

Frequently asked questions