Executive brief
The WP Review Slider Pro plugin for WordPress, which is used to display customer reviews on websites, contains a security flaw that allows unauthorized access to the site's database. By sending a specially crafted request to a public page where the plugin is active, an attacker can bypass security protections to extract sensitive information. This could lead to the exposure of customer data, site configuration details, or other private information stored in the database.
Technical details
The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection due to insufficient input validation and lack of prepared statements in the 'wprp_load_more_revs' AJAX action. The 'notinstring' parameter is processed via sanitize_text_field(), which fails to prevent SQL injection in unquoted numeric contexts. The value is concatenated directly into an 'AND id NOT IN (...)' SQL clause and executed via $wpdb->get_results() without using $wpdb->prepare() or integer casting. Because the AJAX hook is registered via wp_ajax_nopriv and the required nonce is often exposed via wp_localize_script on the frontend, unauthenticated attackers can perform blind or time-based SQL injection to exfiltrate data from the database. The vulnerability is present in versions up to and including 12.7.2.
Affected products
- WP Review Slider WP Review Slider Pro up to, and including, 12.7.2
Timeline
- 2026-07-02: advisory: NVD publication date