CVE-2026-15651 describes a SQL Injection vulnerability (CWE-89) in the WP TripAdvisor Review Slider plugin for WordPress. The issue arises from improper neutralization of special elements in the 'filtersource' parameter, which is insufficiently escaped and not properly prepared in SQL queries. Authenticated attackers with administrator or higher privileges can exploit this to append arbitrary SQL commands to existing queries, potentially extracting sensitive data from the database. The vulnerability affects all plugin versions up to and including 14.6. No patch or official remediation has been published as of the data provided.

An attacker with administrator-level access can exploit this vulnerability to perform SQL Injection attacks, enabling unauthorized extraction of sensitive information from the database. The vulnerability does not affect availability or integrity directly but compromises confidentiality. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and monitor for suspicious activity related to the plugin. Avoid exposing the vulnerable parameter to untrusted inputs. No official patch or temporary fix is currently available.