Is CVE-2026-66427 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-66427 being exploited in the wild.

How severe is CVE-2026-66427?

High severity, with a CVSS score of 7.6, published 27 July 2026.

Which products and versions are affected?

Jgwhite33 WP Google Review Slider <= 18.4.

Is there a fix for CVE-2026-66427?

A patch was published on 2026-07-27: Version 18.5 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-66427 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-66427?

Check whether you run Jgwhite33 WP Google Review Slider at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66427: jgwhite33 WP Google Review Slider SQL injection

Q: Is there a fix for CVE-2026-66427?

A patch was published on 2026-07-27: Version 18.5 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-66427 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-66427?

Check whether you run Jgwhite33 WP Google Review Slider at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66427 · Severity: high · CVSS 7.6 · Published 2026-07-27

WP Google Review Slider, a WordPress plugin used to display Google business reviews on websites, contains a security flaw that could allow an administrative user to execute unauthorized database commands. If exploited, an attacker with high-level access could potentially steal sensitive information from the site's database or cause service disruptions. While the risk is mitigated by the requirement for administrator privileges, organizations should update the plugin to prevent potential internal abuse or escalation from compromised accounts.

Vendors: Jgwhite33.

Quick answers

Is CVE-2026-66427 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-66427 being exploited in the wild.
How severe is CVE-2026-66427?: High severity, with a CVSS score of 7.6, published 27 July 2026.
Which products and versions are affected?: Jgwhite33 WP Google Review Slider <= 18.4.
Is there a fix for CVE-2026-66427?: A patch was published on 2026-07-27: Version 18.5 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-66427 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-66427?: Check whether you run Jgwhite33 WP Google Review Slider at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in the WP Google Review Slider plugin for WordPress due to improper neutralization of special elements used in SQL commands (CWE-89). The flaw is present in versions up to and including 18.4. An attacker with Administrator-level privileges can exploit this vulnerability via network requests to interact directly with the underlying database. Successful exploitation could lead to unauthorized data exfiltration or limited impact on database availability. The issue has been addressed in version 18.5.

Affected products

jgwhite33 WP Google Review Slider <= 18.4

Timeline

2026-07-06: disclosed: Reported by Ananda Dhakal via Patchstack
2026-07-27: advisory: NVD and Patchstack published advisory details
2026-07-27: patched: Version 18.5 released to address the vulnerability

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.