CVE-2026-8441: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in https://wpreviewslider.com/ WP Review Slider Pro
The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' parameter of the wprp_load_more_revs AJAX action in versions up to, and including, 12.7.2. The parameter is read via $_POST['notinstring'] and passed through sanitize_text_field() — which strips HTML and whitespace but does not provide SQL safety. The value is then concatenated directly into a numeric/unquoted `AND id NOT IN (...)` clause and executed via $wpdb->get_results() without $wpdb->prepare() or intval() casting. Because the value sits in an unquoted numeric context, WordPress's wp_magic_quotes protection (which only escapes embedded quotes) is ineffective. The AJAX hook is registered via wp_ajax_nopriv_wprp_load_more_revs, and the required check_ajax_referer nonce is publicly available via wp_localize_script on any frontend page that renders the plugin shortcode, so an unauthenticated attacker who can reach a public page hosting the plugin can extract arbitrary data from the database via blind/time-based injection.
AI Analysis
Technical Summary
The WP Review Slider Pro WordPress plugin is vulnerable to SQL Injection through the 'notinstring' POST parameter in the wprp_load_more_revs AJAX action. The parameter is sanitized using sanitize_text_field(), which removes HTML and whitespace but does not provide SQL injection protection. The value is concatenated directly into an unquoted numeric SQL clause without proper preparation or casting, bypassing WordPress's wp_magic_quotes protection. The AJAX action is accessible without authentication (wp_ajax_nopriv), and the required nonce is exposed on any frontend page rendering the plugin shortcode, enabling unauthenticated attackers to perform blind or time-based SQL injection to extract arbitrary data from the database.
Potential Impact
An unauthenticated attacker can exploit this vulnerability to perform blind or time-based SQL injection attacks, allowing extraction of arbitrary data from the WordPress database. This compromises confidentiality but does not affect integrity or availability according to the CVSS vector.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to pages using the plugin shortcode or disable the plugin to prevent exploitation. Monitor for updates from the vendor and apply official patches once released.
CVE-2026-8441: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in https://wpreviewslider.com/ WP Review Slider Pro
Description
The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' parameter of the wprp_load_more_revs AJAX action in versions up to, and including, 12.7.2. The parameter is read via $_POST['notinstring'] and passed through sanitize_text_field() — which strips HTML and whitespace but does not provide SQL safety. The value is then concatenated directly into a numeric/unquoted `AND id NOT IN (...)` clause and executed via $wpdb->get_results() without $wpdb->prepare() or intval() casting. Because the value sits in an unquoted numeric context, WordPress's wp_magic_quotes protection (which only escapes embedded quotes) is ineffective. The AJAX hook is registered via wp_ajax_nopriv_wprp_load_more_revs, and the required check_ajax_referer nonce is publicly available via wp_localize_script on any frontend page that renders the plugin shortcode, so an unauthenticated attacker who can reach a public page hosting the plugin can extract arbitrary data from the database via blind/time-based injection.
CVSS v3.1
Score 7.5high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The WP Review Slider Pro WordPress plugin is vulnerable to SQL Injection through the 'notinstring' POST parameter in the wprp_load_more_revs AJAX action. The parameter is sanitized using sanitize_text_field(), which removes HTML and whitespace but does not provide SQL injection protection. The value is concatenated directly into an unquoted numeric SQL clause without proper preparation or casting, bypassing WordPress's wp_magic_quotes protection. The AJAX action is accessible without authentication (wp_ajax_nopriv), and the required nonce is exposed on any frontend page rendering the plugin shortcode, enabling unauthenticated attackers to perform blind or time-based SQL injection to extract arbitrary data from the database.
Potential Impact
An unauthenticated attacker can exploit this vulnerability to perform blind or time-based SQL injection attacks, allowing extraction of arbitrary data from the WordPress database. This compromises confidentiality but does not affect integrity or availability according to the CVSS vector.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to pages using the plugin shortcode or disable the plugin to prevent exploitation. Monitor for updates from the vendor and apply official patches once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-05-12T19:15:15.187Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a4634ad27e9c79719a6e412
Added to database: 07/02/2026, 09:51:41 UTC
Last enriched: 07/02/2026, 10:06:24 UTC
Last updated: 08/16/2026, 00:41:16 UTC
Views: 72
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.