CVE-2026-84097 in wp-review-slider-pro Plugin
Summary
by MITRE • 09/26/2026
The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are then returned to unauthenticated visitors.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified in wp-review-slider-pro versions prior to 12.7.12 represents a critical intersection of authentication bypass and database manipulation flaws within the WordPress ecosystem. The core issue stems from an AJAX handler that fails to enforce proper capability checks, meaning it does not verify whether the requesting user possesses the necessary permissions to execute the action. In standard WordPress security architecture, non-administrative roles such as subscribers should be restricted from performing administrative or sensitive data operations. By omitting this check, the plugin inadvertently grants access to functionality intended for higher-privileged users, effectively allowing any authenticated account, regardless of its role level, to trigger the vulnerable code path. This lack of authorization control is a significant deviation from secure coding practices and establishes an unauthorized entry point into the application logic.
Beyond the authentication flaw, the technical severity is amplified by the absence of input sanitization on values passed through this AJAX endpoint before they are incorporated into SQL queries. The developer failed to implement prepared statements or proper escaping mechanisms for user-supplied data. This oversight allows attackers to inject malicious SQL code directly into database commands. Because the results of these injected queries are returned in the HTTP response, the vulnerability facilitates a classic blind and error-based SQL injection scenario where the attacker can extract sensitive information from the WordPress database. The ability to retrieve query results means that an attacker can enumerate table structures, dump user credentials including password hashes, access plugin configuration data, or potentially exfiltrate other site-specific content stored in the database.
The operational impact of this vulnerability is severe due to its remote exploitable nature and low barrier to entry for attackers. Since only authenticated access is required, which many WordPress sites have open to subscribers via registration forms, the attack surface is significantly expanded compared to vulnerabilities requiring administrator privileges. An attacker can leverage automated tools like sqlmap or custom scripts to probe the database structure and extract data without needing high-level credentials. The returned results allow for further exploitation chains, such as credential stuffing attacks if password hashes are compromised, or privilege escalation if administrative details are exposed. Furthermore, depending on the specific SQL injection technique used, there may be risks associated with out-of-band interactions that could lead to server-side request forgery or remote code execution in certain database configurations, although the primary immediate risk is data exfiltration.
From a standards perspective, this vulnerability maps directly to CWE-89 for Improper Neutralization of Special Elements used in an SQL Command and CWE-269 for Improper Privilege Assignment. The failure to check capabilities aligns with ATT&CK technique T1078 Valid Accounts, where attackers leverage legitimate credentials to move laterally or access resources they should not have permission to view. Mitigation strategies must prioritize immediate patching by upgrading the wp-review-slider-pro plugin to version 12.7.12 or higher, which addresses these specific flaws. For sites unable to update immediately due to compatibility concerns, temporary mitigations include restricting public registration if feasible, implementing a Web Application Firewall rule set designed to detect SQL injection patterns in AJAX requests, and ensuring that all custom code adheres to WordPress coding standards by utilizing $wpdb->prepare for database interactions and current_user_can checks for authorization. Regular security audits of third-party plugins are essential to prevent similar oversights from compromising site integrity.