This vulnerability (CVE-2026-66427) in the WP Google Review Slider plugin (by jgwhite33) is an SQL Injection flaw classified under CWE-89. It affects versions up to and including 18.4, allowing an attacker with administrator privileges to inject malicious SQL commands. The CVSS 3.1 base score is 7.6, reflecting network attack vector, low attack complexity, required privileges at the administrator level, no user interaction, and a scope change. The impact includes high confidentiality compromise and low availability impact, with no integrity impact reported. No official patch or remediation guidance is currently available, and no known exploits in the wild have been reported.

An attacker with administrator privileges can exploit this SQL Injection vulnerability to execute arbitrary SQL commands on the backend database. This may lead to unauthorized disclosure of sensitive information (high confidentiality impact) and partial disruption of service (low availability impact). The integrity of data is not directly impacted according to the CVSS vector. The vulnerability requires administrator-level privileges and does not require user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, administrators should monitor the vendor's communications for updates. Until a patch is released, restricting administrator access to trusted personnel and minimizing exposure of the affected plugin may reduce risk.