CVE-2026-8441: WP Review Slider Pro SQL Injection Flaw

CVE-2026-8441 Overview

CVE-2026-8441 is an unauthenticated SQL injection vulnerability in the WP Review Slider Pro plugin for WordPress. The flaw affects all versions up to and including 12.7.2. The vulnerability resides in the wprp_load_more_revs AJAX action, where the notinstring POST parameter is concatenated directly into a SQL query without proper sanitization or parameter binding. The plugin registers the AJAX hook via wp_ajax_nopriv_wprp_load_more_revs, exposing it to unauthenticated attackers. An attacker who can reach any public page rendering the plugin shortcode can extract arbitrary database contents using blind or time-based SQL injection techniques [CWE-89].

Critical Impact

Unauthenticated remote attackers can extract sensitive database contents, including user credentials and session tokens, from any WordPress site running a vulnerable version of WP Review Slider Pro.

Affected Products

• WP Review Slider Pro plugin for WordPress
• All versions up to and including 12.7.2
• Any WordPress site publicly rendering the plugin's shortcode

Discovery Timeline

• 2026-07-02 - CVE-2026-8441 published to NVD
• 2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-8441

Vulnerability Analysis

The vulnerability stems from unsafe handling of user input within the wprp_load_more_revs AJAX handler. The plugin reads the notinstring parameter directly from $_POST and passes it through sanitize_text_field(). This WordPress function strips HTML tags and whitespace but performs no SQL escaping or type coercion. The sanitized value is then concatenated into an AND id NOT IN (...) clause and executed via $wpdb->get_results() without $wpdb->prepare() or intval() casting.

Because the injection point sits in an unquoted numeric context, WordPress's built-in wp_magic_quotes defense provides no protection. That mechanism only escapes embedded single and double quotes, leaving numeric injection payloads such as SQL keywords, subqueries, and time-delay functions fully executable.

Root Cause

The root cause is the absence of prepared statements combined with reliance on sanitize_text_field() for SQL safety. This function is a string cleaner, not a SQL escaping routine. Direct concatenation of attacker-controlled data into a numeric SQL context violates secure query construction guidelines and triggers the classic SQL injection pattern described by [CWE-89].

Attack Vector

The AJAX endpoint is registered through wp_ajax_nopriv_wprp_load_more_revs, making it reachable by unauthenticated visitors. The required check_ajax_referer nonce is emitted publicly via wp_localize_script on any frontend page that renders the plugin shortcode. An attacker retrieves the nonce from the page source, then issues a crafted POST request to admin-ajax.php with a malicious notinstring payload. Blind and time-based techniques allow byte-by-byte extraction of arbitrary rows from the WordPress database, including the wp_users table.

No verified exploit code has been published. See the Wordfence Vulnerability Report for further technical details.

Detection Methods for CVE-2026-8441

Indicators of Compromise

• POST requests to /wp-admin/admin-ajax.php with the action=wprp_load_more_revs parameter and unusual notinstring values containing SQL keywords such as SLEEP, SELECT, UNION, or BENCHMARK.
• Sustained response time delays on admin-ajax.php responses consistent with time-based blind injection probes.
• High-volume, low-frequency AJAX requests from a single source targeting pages that render the WP Review Slider Pro shortcode.

Detection Strategies

• Inspect web server access logs for admin-ajax.php requests where the notinstring POST body contains non-numeric characters.
• Enable WordPress query logging or use a database activity monitor to flag queries containing AND id NOT IN ( followed by SQL functions or nested SELECT statements.
• Deploy Web Application Firewall (WAF) rules that block SQL metacharacters in AJAX POST parameters targeting the vulnerable action.

Monitoring Recommendations

• Monitor outbound database query latency for anomalous spikes tied to specific AJAX endpoints.
• Alert on repeated check_ajax_referer validations from the same IP against the wprp_load_more_revs action.
• Correlate WordPress error logs with web access logs to identify malformed query patterns indicative of injection attempts.

How to Mitigate CVE-2026-8441

Immediate Actions Required

• Update WP Review Slider Pro to a version later than 12.7.2 as soon as the vendor releases a patched build. Consult the WPreviewSlider Change Log for release status.
• If a patched version is not yet available, deactivate and remove the plugin from all WordPress installations.
• Audit database logs and user tables for signs of unauthorized data extraction prior to patching.

Patch Information

Refer to the vendor's official change log at WPreviewSlider Change Log for the fixed release. The Wordfence Vulnerability Report tracks patch availability and should be checked before applying an update.

Workarounds

• Remove the plugin shortcode from all publicly accessible pages to prevent the nonce from being exposed via wp_localize_script.
• Deploy a WAF rule that rejects POST requests to admin-ajax.php where action=wprp_load_more_revs and notinstring contains non-digit characters.
• Restrict access to /wp-admin/admin-ajax.php for the vulnerable action using server-level access controls until a patch is installed.

# Example ModSecurity rule to block non-numeric notinstring payloads
SecRule ARGS:action "@streq wprp_load_more_revs" \
  "id:1008441,phase:2,chain,deny,status:403,log,\
  msg:'CVE-2026-8441 WP Review Slider Pro SQLi attempt'"
  SecRule ARGS:notinstring "!@rx ^[0-9,]*$"