The WP Review Slider Pro WordPress plugin is vulnerable to SQL Injection through the 'notinstring' POST parameter in the wprp_load_more_revs AJAX action. The parameter is sanitized using sanitize_text_field(), which removes HTML and whitespace but does not provide SQL injection protection. The value is concatenated directly into an unquoted numeric SQL clause without proper preparation or casting, bypassing WordPress's wp_magic_quotes protection. The AJAX action is accessible without authentication (wp_ajax_nopriv), and the required nonce is exposed on any frontend page rendering the plugin shortcode, enabling unauthenticated attackers to perform blind or time-based SQL injection to extract arbitrary data from the database.

An unauthenticated attacker can exploit this vulnerability to perform blind or time-based SQL injection attacks, allowing extraction of arbitrary data from the WordPress database. This compromises confidentiality but does not affect integrity or availability according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to pages using the plugin shortcode or disable the plugin to prevent exploitation. Monitor for updates from the vendor and apply official patches once released.