CVE-2026-8444

The record

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs[]' parameter of the wpfb_find_reviews AJAX action in versions up to, and including, 12.6.8. This is due to the handler reading $_POST['curselrevs'] raw with no sanitization or type casting, then concatenating each array element directly into a `WHERE id IN ( ... )` clause without quoting and executing via $wpdb->get_results() without $wpdb->prepare(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Affected packages

Related vulnerabilities

• CVE-2026-87936 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')… CWE-89
• CVE-2026-87938 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')… CWE-89
• CVE-2026-114664 Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the… CWE-89
• CVE-2026-114577 A vulnerability was found in oretnom23 php-travel-agency-system. CWE-89
• CVE-2026-113406 BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. CWE-89
• CVE-2026-113405 BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. CWE-89
• CVE-2026-107081 SQL injection via identifier injection in the tableName and tableFields POST parameters… CWE-89
• CVE-2026-112150 A security flaw has been discovered in vraj404 Criminal-Management-System up to… CWE-89