The WP Review Slider Pro WordPress plugin (up to version 12.6.8) contains an SQL Injection vulnerability in the wpfb_find_reviews AJAX action. The 'curselrevs[]' POST parameter is used directly in a SQL WHERE clause without sanitization or parameterization, allowing authenticated attackers with Subscriber-level privileges or higher to inject arbitrary SQL commands. This occurs because the plugin concatenates each element of the 'curselrevs' array directly into a 'WHERE id IN (...)' clause and executes the query via $wpdb->get_results() without using $wpdb->prepare(), leading to improper neutralization of special elements in SQL commands (CWE-89).

An attacker with at least Subscriber-level access can exploit this vulnerability to perform SQL Injection attacks, potentially extracting sensitive information from the database, modifying data, or causing denial of service. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict or monitor user roles that have access to the vulnerable AJAX action. Avoid granting Subscriber-level or higher privileges to untrusted users. Consider applying custom input validation or disabling the vulnerable AJAX action if feasible.