Quick answers
- Is CVE-2026-8441 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-8441 being exploited in the wild.
- How severe is CVE-2026-8441?
- High severity, with a CVSS score of 7.5, published 2 July 2026.
- Which products and versions are affected?
- WP Review Slider up to, and including, 12.7.2; WP Review Slider Pro up to, and including, 12.7.2.
- Is there a fix for CVE-2026-8441?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-8441 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-8441?
- Check whether you run WP Review Slider or WP Review Slider Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection due to insufficient input validation and lack of prepared statements in the 'wprp_load_more_revs' AJAX action. The 'notinstring' parameter is processed via sanitize_text_field(), which fails to prevent SQL injection in unquoted numeric contexts. The value is concatenated directly into an 'AND id NOT IN (...)' SQL clause and executed via $wpdb->get_results() without using $wpdb->prepare() or integer casting. Because the AJAX hook is registered via wp_ajax_nopriv and the required nonce is often exposed via wp_localize_script on the frontend, unauthenticated attackers can perform blind or time-based SQL injection to exfiltrate data from the database. The vulnerability is present in versions up to and including 12.7.2.
Affected products
- WP Review Slider WP Review Slider Pro up to, and including, 12.7.2
Timeline
- 2026-07-02: advisory: NVD publication date