CVE-2026-84096 in wp-review-slider-pro Plugin
Summary
by MITRE • 09/26/2026
The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on the AJAX handler that saves its review submission forms, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to overwrite a live form with field values that are output without escaping on public pages, leading to Stored Cross-Site Scripting.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified in wp-review-slider-pro versions prior to 12.7.12 represents a critical failure in access control and input validation within the plugin's AJAX handler architecture. The core technical flaw lies in the absence of proper capability checks when processing requests intended to save review submission forms. In secure WordPress development, any action that modifies data or performs administrative-like functions must verify that the requesting user possesses specific capabilities, such as edit_posts or manage_options, depending on the context. By omitting this verification step, the plugin inadvertently exposes a functionality that should be restricted to higher-privileged users to all authenticated accounts, including those with minimal privileges like subscribers. This lack of authorization enforcement allows any logged-in user to interact directly with the server-side logic responsible for persisting form data without restriction.
Compounding the access control failure is the improper implementation of nonce validation. Nonces in WordPress are designed to prevent Cross-Site Request Forgery by ensuring that a request originates from an expected source and was initiated within a valid timeframe. However, in this specific handler, the nonce generated for each visitor does not adequately bind the request to a specific user session or context in a way that prevents unauthorized modification of existing data structures. This weakness effectively neutralizes one layer of defense against forged requests, allowing attackers to craft malicious AJAX payloads that are accepted by the server as legitimate operations. The combination of missing capability checks and weak nonce validation creates an environment where authenticated users can manipulate backend processes with minimal effort.
The operational impact of this vulnerability is severe due to the subsequent lack of output escaping on public-facing pages. When a user submits or modifies a review form, the data entered into the fields is stored in the database without being sanitized for HTML entities. Later, when these reviews are displayed on the front end of the website, the raw content is rendered directly by the browser. This behavior facilitates Stored Cross-Site Scripting attacks. An attacker can inject malicious JavaScript code through the review submission form, which then persists in the database and executes automatically whenever a victim visits the page displaying that specific review. Unlike reflected XSS, where the payload must be delivered via a link, stored XSS ensures persistent execution across multiple user sessions, potentially leading to session hijacking, defacement, or redirection to malicious sites for any visitor who views the compromised content.
From a classification perspective, this vulnerability aligns with CWE-862 Missing Authorization and CWE-79 Improper Neutralization of Input During Web Page Generation Commonly Known as Cross-Site Scripting. The failure to check user capabilities before performing state-changing operations is a textbook example of broken access control, while the storage and unescaped output of user-supplied data constitutes persistent XSS. In terms of the MITRE ATT&CK framework for enterprise security, this vulnerability maps to T1059 Command and Scripting Interpreter through JavaScript execution on client-side systems, and potentially T1136 Create Account if an attacker leverages the stored script to escalate privileges or exfiltrate credentials from other users. The attack vector is classified as Network-based with Authentication required, placing it in the initial access phase of a typical cyber kill chain for web applications.
Mitigation strategies must address both the immediate code flaws and broader security hygiene practices. For administrators using affected versions, upgrading to version 12.7.12 or later is the primary remediation step as these updates include the necessary capability checks and nonce validations. In environments where patching is not immediately feasible, implementing a Web Application Firewall can help block malicious payloads attempting to exploit the AJAX endpoint by filtering out scripts in POST requests. Additionally, developers should enforce strict output escaping using functions like esc_html or wp_kses_post when rendering user-generated content on public pages. It is also critical to ensure that all AJAX handlers utilize current_user_can checks and verify nonces generated with the specific action string associated with the handler to prevent forgery. Regular security audits of third-party plugins are essential to identify such logic flaws before they can be exploited in production environments.