CVE-2026-8444

Name of the Vulnerable Software and Affected Versions WP Review Slider Pro versions prior to 12.6.9

Description The WP Review Slider Pro plugin for WordPress contains a flaw allowing authenticated attackers with Subscriber-level access or higher to execute additional SQL queries to extract sensitive database information. The issue occurs within the 'wpfb find reviews' AJAX action, where the curselrevs[] parameter is processed without sanitization or type casting. The handler concatenates array elements directly into a WHERE id IN ( ... ) clause and executes them via the $wpdb->get results() function without using $wpdb->prepare(), which is a method used to secure SQL queries by parameterizing inputs.

Recommendations Update the plugin to a version later than 12.6.8. As a temporary workaround, restrict access to the 'wpfb find reviews' AJAX action for users with Subscriber-level permissions.