Description

Subscriber SQL Injection in Reviewer <= 3.14.2 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-08-13T14:17:09.603Z",
  "pubdate": "2026-08-13T14:17:09.603Z",
  "executiveSummary": "A Subscriber SQL Injection vulnerability has been identified in the Reviewer plugin, affecting versions <= 3.14.2. This security flaw arises from improper sanitization and validation of user-supplied input before it is concatenated directly into SQL queries executed against the underlying database. An authenticated remote attacker possessing low-privileged Subscriber access can exploit this vulnerability to manipulate database queries.\nThe primary impact of this vulnerability includes unauthorized database access, potential extraction of sensitive information such as user credentials and site configurations, data tampering, and potential escalation of privileges within the application environment. Because the database handles critical application data, successful exploitation severely compromises the confidentiality, integrity, and availability of the affected system.\nExploitation requirements are limited to low-privileged Subscriber authentication, meaning an attacker must first obtain a valid user account with subscriber-level permissions. No complex social engineering or advanced network positioning is required beyond HTTP/HTTPS access to the target application. Organizations utilizing the affected Reviewer plugin versions are at significant risk until remediation actions are successfully deployed.",
  "technicalDetails": "The vulnerability is rooted in the insecure handling of database queries within the Reviewer plugin versions <= 3.14.2. Specifically, the vulnerable component fails to properly parameterize user-controlled input parameters or utilize prepared statements before executing database operations. This allows untrusted input to alter the abstract syntax tree of the SQL query, enabling SQL injection.\nAuthentication requirements dictate that the attacker must authenticate to the target system with at least a Subscriber role. Network exposure is standard web application exposure via HTTP/HTTPS protocols, typically reachable over the internet or an internal network depending on the deployment topology. Privilege requirements are minimal, constrained only to standard subscriber privileges rather than administrative access.\nThe attack flow proceeds as follows: First, the authenticated attacker crafts a malicious HTTP request targeting the vulnerable endpoint or functionality within the Reviewer plugin. This request injects specialized SQL syntax into parameters that are unsafely processed by the backend PHP code. Second, the application concatenates the tainted input directly into the database query string without prior neutralization or proper type casting. Third, the database management system parses and executes the modified query, returning unintended result sets or executing unauthorized database commands based on the injected payload behavior.\nPayload behavior during successful exploitation typically involves union-based extraction, boolean-based blind inference, or time-based blind SQL injection techniques. Attackers can leverage these techniques to enumerate database schemas, dump table contents, or interact with the underlying operating system depending on database configuration privileges. Post-exploitation impact encompasses full database compromise, potential session hijacking, and persistent access via malicious database modifications."
}