Description

The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are then returned to unauthenticated visitors.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-26T07:17:02.723Z",
  "pubdate": "2026-09-26T07:17:02.723Z",
  "executiveSummary": "The WP Review Slider Pro plugin before version 12.7.12 contains a critical SQL injection vulnerability originating from an insecure AJAX handler.\nThis flaw allows authenticated users, including those with minimal privileges such as subscribers, to inject arbitrary SQL queries into the database.\nThe vulnerability is characterized by a failure to perform adequate input sanitization and an absence of capability checks on the affected AJAX endpoint.\nA significant risk factor is that the results of the injected SQL commands are reflected and returned to unauthenticated visitors, potentially leading to unauthorized data exfiltration.\nBy manipulating database queries, an attacker can bypass authentication, extract sensitive information, or modify database contents.\nThe requirement for authenticated access is low, given that standard subscriber-level accounts can trigger the exploit.\nOrganizations using versions prior to 12.7.12 are exposed to database compromise through this vector.",
  "technicalDetails": "The vulnerability resides within an AJAX-enabled handler in the WP Review Slider Pro plugin, which fails to implement necessary access control mechanisms and input validation.\nSpecifically, the plugin exposes an AJAX action that accepts user-supplied input intended for use in a database query. Because the application does not verify the user's capabilities, any authenticated user—regardless of their WordPress role—can invoke this handler.\nThe root cause is the improper handling of user-controllable data before it is processed by the WordPress database abstraction layer, likely involving the direct concatenation of unsanitized parameters into a SQL statement instead of utilizing prepared statements or robust parameterization.\nThe exploitation flow begins with a subscriber-level user sending a crafted request to the vulnerable AJAX endpoint. By injecting malicious SQL syntax into the specific parameter processed by the handler, the attacker can manipulate the query structure.\nBecause the application is designed to return the results of these queries back to the front-end, the output of the injected SQL command—which could include user metadata, plugin configuration, or other sensitive table data—is leaked to the browser.\nThis behavior persists even when the request is observed by or results are returned to unauthenticated visitors, as the underlying query execution occurs on the server side and the output is subsequently reflected.\nThis vulnerability is particularly severe because it effectively elevates the privileges of low-level accounts, providing them with read-access to the entire WordPress database schema. The ability to exfiltrate sensitive data without administrative privileges makes this an high-impact security flaw.\nAffected versions are all iterations prior to 12.7.12. Security analysis indicates that the lack of sanitization is pervasive in this specific handler, and the missing capability check (e.g., using current_user_can()) allows any logged-in user to reach the vulnerable code path."
}