WP Review Slider Pro Unauthenticated SQL Injection Advisory (CVE-2026-8441)

Vulnerability Overview Vulnerability Name: WP Review Slider Pro <= 12.7.2 - Unauthenticated SQL Injection via 'notinstring' Parameter Vulnerability Type: SQL Injection CVSS Score: 7.5 (High) CVE ID: CVE-2026-8441 Publication Date: July 1, 2026 Last Updated: July 2, 2026 Researcher: h0xlo Scope of Impact Affected Software: WP Review Slider Pro Affected Versions: <= 12.7.2 Software Type: Plugin Software Slug: wp-review-slider-pro Patch Available: Yes Fixed Version: 12.7.3 Remediation Recommendation: Update to version 12.7.3 or a later patched version Vulnerability Description The WP Review Slider Pro plugin (versions 12.7.2 and earlier) contains an SQL injection vulnerability in the 'notinstring' parameter. This parameter is read via , processed with , but does not provide SQL security. The value is directly concatenated into a numeric/unquoted clause and executed via without using or for sanitization. Because the value resides in an unquoted numeric context, WordPress's protection (which only escapes embedded quotes) is ineffective. The AJAX hook is registered under , and the required nonce is exposed publicly via on the frontend page. Consequently, any unauthenticated attacker can access the public page hosting the plugin and extract arbitrary data from the database via blind time-based injection. References WP Review Slider Pro Share Options Facebook Twitter LinkedIn Email Additional Information Recent Vulnerabilities: - WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber) Arbitrary File Deletion via 'injection' Parameter (CVE-2026-8442, CVSS 8.1, June 15, 2026) - WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber) SQL Injection via 'curatelist' Parameter (CVE-2026-8444, CVSS 8.8, June 15, 2026) - WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber) SQL Injection via 'stypes' Parameter (CVE-2026-8443, CVSS 8.8, June 15, 2026) Copyright Copyright Owner: Defiant Inc. and The MITRE Corporation License: Used under the terms of Defiant Inc. and The MITRE Corporation Contact Information Technical Support: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24/7/365 support with a 1-hour response time Other Links Products: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central Support: Documentation, Learning Center, Free Support, Premium Support News: Blog, In The News, Vulnerability Advisories About: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form Subscribe: Subscribe to news and updates by filling in your email Footer Information Terms of Service: Terms of Service Privacy Policy: Privacy Policy and Notice at Collection Data Sales: Do Not Sell or Share My Personal Information Social Media: X, Facebook, YouTube, Instagram Copyright: © 2012-2026 Defiant Inc. All Rights Reserved

Goal Reached Thanks to every supporter — we hit 100%!

WP Review Slider Pro Unauthenticated SQL Injection Advisory (CVE-2026-8441)

More from this source