What the vulnerability does
01Description
The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs[]' parameter of the wpfb_find_reviews AJAX action in versions up to, and including, 12.6.8. This is due to the handler reading $_POST['curselrevs'] raw with no sanitization or type casting, then concatenating each array element directly into a `WHERE id IN ( ... )` clause without quoting and executing via $wpdb->get_results() without $wpdb->prepare(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Explanation of Vulnerability in Simple Terms
02Summary
WP Review Slider Pro versions up to 12.6.8 contain a SQL injection vulnerability in database queries. An authenticated user with low privileges can inject malicious SQL code to read, modify, or delete database records. The vulnerability requires valid site access but no special user role. All data stored in the site's database is at risk.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete any data in the site's database using SQL injection.
Potential impact on your site
04Site Impact
Database contents can be compromised, including user credentials, posts, settings, and customer data if present.
Conditions required to exploit
05Prerequisites
Attacker must have a valid user account with low-level site access (e.g., subscriber or contributor role).
Key dates
06Disclosure timeline
June 16, 2026
CVE published
