SQL Injection Vulnerability in WP Review Slider Pro Plugin by WordPress

CVE-2026-8444

What is CVE-2026-8444?

The WP Review Slider Pro plugin for WordPress has a security flaw that allows authenticated users with Subscriber-level access and higher to perform SQL Injection attacks. This vulnerability exists in the 'curselrevs[]' parameter processed by the wpfb_find_reviews AJAX action. Due to the lack of input sanitization and type casting, attackers can inject additional SQL queries into the existing database queries. This could lead to unauthorized access to sensitive information stored in the database, posing significant security risks for affected WordPress installations.

References