CVE-2025-26946: WP Yelp Review Slider SQLi Vulnerability

CVE-2025-26946 Overview

CVE-2025-26946 is a blind SQL injection vulnerability in the WP Yelp Review Slider WordPress plugin developed by jgwhite33. The flaw affects all plugin versions up to and including 8.1 and stems from improper neutralization of special elements in SQL commands [CWE-89]. An authenticated attacker with high privileges can inject crafted SQL payloads into vulnerable parameters processed by the plugin. Successful exploitation enables data extraction from the underlying WordPress database, including credentials, session tokens, and stored content. The scope-changing nature of the issue extends impact beyond the plugin context to the broader WordPress installation.

Critical Impact
Authenticated attackers can extract sensitive data from the WordPress database via time-based or boolean-based blind SQL injection, with confidentiality impact rated high.

Affected Products

WP Yelp Review Slider plugin (wp-yelp-review-slider) versions through 8.1
WordPress sites using the jgwhite33 WP Yelp Review Slider plugin
Any WordPress deployment where the plugin is installed and active

Discovery Timeline

2025-02-25 - CVE-2025-26946 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-26946

Vulnerability Analysis

The vulnerability is a blind SQL injection issue in the WP Yelp Review Slider plugin. The plugin fails to properly sanitize or parameterize user-supplied input before incorporating it into SQL queries against the WordPress database. Because the injection is blind, attackers infer query results through inference techniques such as boolean conditions or time delays rather than direct error output.

Exploitation requires network access to the WordPress admin interface and authenticated privileges. The scope is marked as changed, indicating that successful exploitation impacts resources beyond the vulnerable component. Confidentiality impact is high because attackers can read arbitrary database tables, while integrity remains unaffected and availability is limited.

Root Cause

The root cause is the concatenation of untrusted input directly into SQL statements without using prepared statements or the WordPress $wpdb->prepare() function. WordPress provides wpdb placeholder-based query construction specifically to prevent this class of bug, but the affected plugin code paths bypass that mechanism. This pattern matches CWE-89, Improper Neutralization of Special Elements used in an SQL Command.

Attack Vector

An authenticated user with elevated privileges sends crafted HTTP requests to plugin endpoints that accept parameters incorporated into SQL queries. The attacker iteratively injects conditional payloads (for example, AND SLEEP(5) or AND SUBSTRING(...)=...) and observes response timing or behavioral differences to extract data character-by-character. No user interaction is required beyond the attacker's own session.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Patchstack WordPress Vulnerability advisory for additional technical context.

Detection Methods for CVE-2025-26946

Indicators of Compromise

HTTP requests to WP Yelp Review Slider plugin endpoints containing SQL keywords such as UNION, SELECT, SLEEP, BENCHMARK, or encoded variants
Unusual database query latency or repeated requests differing only by single-character payload values, indicating blind SQL inference
WordPress access logs showing high-volume authenticated requests to wp-admin plugin AJAX or REST endpoints associated with wp-yelp-review-slider
Database error log entries referencing malformed SQL originating from plugin-handled queries

Detection Strategies

Deploy a web application firewall rule set that inspects request parameters for SQL injection signatures targeting WordPress plugin endpoints
Enable WordPress query logging or use a database activity monitor to flag unparameterized queries originating from plugin code paths
Correlate authenticated administrative sessions with sudden spikes in database read operations against wp_options, wp_users, or wp_usermeta

Monitoring Recommendations

Forward WordPress access logs and MySQL/MariaDB general query logs to a centralized analytics platform for retrospective hunting
Alert on time-based payload patterns (SLEEP, WAITFOR DELAY, BENCHMARK) appearing in plugin request bodies or query strings
Track plugin version inventory across managed WordPress sites and alert on instances running wp-yelp-review-slider at version 8.1 or earlier

How to Mitigate CVE-2025-26946

Immediate Actions Required

Identify all WordPress sites running the WP Yelp Review Slider plugin and verify installed versions
Update the plugin to a patched release once available from the vendor, or deactivate and remove it from production sites
Restrict administrative access to trusted users and rotate any credentials exposed through privileged accounts
Audit recent administrator activity for evidence of SQL injection probing or anomalous database reads

Patch Information

The vendor advisory is tracked through Patchstack. Site owners should consult the Patchstack advisory for the latest fixed version information and apply updates through the WordPress plugin management interface.

Workarounds

Deactivate and uninstall the WP Yelp Review Slider plugin until a fixed version is installed
Apply WAF virtual patching rules that block SQL injection payloads targeting plugin endpoints
Enforce least-privilege role assignments so that fewer accounts hold the high privileges required for exploitation
Enable Patchstack, Wordfence, or equivalent virtual patching coverage for managed WordPress fleets

bash

# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate wp-yelp-review-slider
wp plugin delete wp-yelp-review-slider

# Verify removal across a multisite network
wp site list --field=url | xargs -I {} wp --url={} plugin status wp-yelp-review-slider