CVE-2026-66427: WP Google Review Slider SQLi Vulnerability

CVE-2026-66427 Overview

CVE-2026-66427 is a SQL injection vulnerability affecting the WP Google Review Slider WordPress plugin in versions 18.4 and earlier. The flaw allows an authenticated administrator to inject arbitrary SQL statements into database queries handled by the plugin. Successful exploitation exposes database contents and can degrade site availability. The issue is tracked under [CWE-89] and documented in the Patchstack SQL Injection Advisory.

Critical Impact
An attacker with administrator privileges can read confidential database content and impact site availability through crafted SQL payloads sent to the vulnerable plugin endpoints.

Affected Products

WP Google Review Slider plugin for WordPress, versions <= 18.4
WordPress sites using the wp-google-places-review-slider plugin
All WordPress installations where the plugin is active and administrator accounts exist

Discovery Timeline

2026-07-27 - CVE-2026-66427 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-66427

Vulnerability Analysis

The vulnerability is a SQL injection flaw in the WP Google Review Slider plugin. Plugin code constructs SQL queries using input reachable by administrator users without adequate parameterization. An attacker who controls an administrator session can append SQL fragments to legitimate query parameters. The scope is marked as changed, meaning the injected query can affect resources beyond the plugin's own boundary. Confidentiality impact is high because the WordPress database stores user records, password hashes, session tokens, and site secrets.

Root Cause

The root cause is missing or incomplete sanitization of user-controlled input passed to database functions such as $wpdb->query() or $wpdb->get_results(). Administrator-controlled fields, likely tied to plugin configuration or review management endpoints, are concatenated into SQL statements rather than being bound through $wpdb->prepare(). This pattern maps to [CWE-89], Improper Neutralization of Special Elements used in an SQL Command.

Attack Vector

An attacker must first obtain administrator credentials through phishing, credential reuse, or a separate privilege escalation. The attacker then sends a crafted request to an authenticated plugin endpoint, embedding SQL metacharacters in a parameter that reaches the vulnerable query. The payload executes against the WordPress database with the privileges of the WordPress database user. Because the attack is remote and low complexity, no user interaction is required beyond the attacker's own authenticated session.

See the Patchstack SQL Injection Advisory for advisory-level technical details.

Detection Methods for CVE-2026-66427

Indicators of Compromise

Unexpected SQL syntax such as UNION SELECT, SLEEP(, or information_schema in WordPress admin-ajax.php or plugin endpoint request logs
Administrator session activity originating from unusual IP addresses or user agents targeting wp-google-places-review-slider paths
Anomalous database error messages logged by wpdb referencing plugin table names
Sudden increases in query duration or row counts against WordPress core tables such as wp_users and wp_options

Detection Strategies

Enable WordPress debug logging and review wpdb error output for malformed queries tied to the plugin
Deploy a web application firewall rule set that inspects authenticated POST parameters for SQL injection signatures
Correlate administrator login events with subsequent plugin endpoint requests to identify anomalous sequences
Baseline normal plugin request patterns and alert on parameter values containing SQL operators or comment markers

Monitoring Recommendations

Forward WordPress access logs, PHP error logs, and MySQL general or slow query logs to a centralized analytics platform
Monitor for privilege escalation attempts and successful administrator authentications from new geographies
Track file integrity of plugin directories under wp-content/plugins/wp-google-places-review-slider/
Alert on outbound data transfers from the web tier that exceed baseline volumes, which may indicate database exfiltration

How to Mitigate CVE-2026-66427

Immediate Actions Required

Update the WP Google Review Slider plugin to a version later than 18.4 as soon as a patched release is available
Audit administrator accounts and remove or disable any that are inactive, shared, or unnecessary
Rotate WordPress administrator passwords and enforce multi-factor authentication for all privileged accounts
Review WordPress and database logs for signs of prior exploitation dating back to plugin installation

Patch Information

Refer to the Patchstack SQL Injection Advisory for the current fixed version and vendor guidance. Apply updates through the WordPress plugin management interface or WP-CLI, and verify the installed version after patching.

Workarounds

Deactivate the WP Google Review Slider plugin until a patched version is installed
Restrict access to /wp-admin/ by IP allowlist at the web server or WAF layer to limit administrator endpoint exposure
Apply virtual patching rules in a WAF to block SQL metacharacters in plugin-specific parameters
Enforce the principle of least privilege on the WordPress database user by removing rights such as FILE and DROP where feasible

bash

# Configuration example: update the plugin using WP-CLI once a fixed version is published
wp plugin update wp-google-places-review-slider
wp plugin list --name=wp-google-places-review-slider --fields=name,status,version