CVE-2026-8441

Name of the Vulnerable Software and Affected Versions WP Review Slider Pro versions prior to 12.7.3

Description An unauthenticated attacker can extract arbitrary data from the database using blind or time-based SQL injection. The issue occurs within the wprp load more revs AJAX action, where the notinstring parameter is processed. The application uses sanitize text field() on the input, which removes HTML and whitespace but fails to ensure SQL safety. This value is then concatenated directly into an unquoted AND id NOT IN (...) clause and executed via $wpdb->get results() without using $wpdb->prepare() or intval() casting. Because the input is placed in a numeric context, standard quote-escaping protections are ineffective. The required nonce for the wp ajax nopriv wprp load more revs hook is publicly accessible on any frontend page rendering the plugin shortcode.

Recommendations Update to a version newer than 12.7.2. As a temporary mitigation, restrict access to the wprp load more revs AJAX action or avoid using the notinstring parameter.