CVE-2026-84097 Details
Description
The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are then returned to unauthenticated visitors.
A SQL injection vulnerability has been identified in the WP Review Slider Pro WordPress plugin, affecting versions prior to 12.7.12. The issue arises because the plugin's AJAX handlers do not properly sanitize values before incorporating them into SQL statements. This lack of sanitation, combined with the absence of a capability check, enables authenticated users, such as subscribers, to execute SQL injection attacks. The exploitation of this vulnerability can lead to the injection of malicious SQL, with the potential for unauthorized data access or manipulation. Notably, the results of these SQL injection attacks are returned to unauthenticated visitors, amplifying the impact of the vulnerability.
Users are advised to update the WP Review Slider Pro WordPress plugin to version 12.7.12 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 26, 2026CISA-ADP
Assessed Sep 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/6d51f9c7-3140-4261-954b-8fc497587359/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| wp-review-slider-pro | < 12.7.12 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 26, 2026 | CVE Modified | CISA-ADP |
| Sep 26, 2026 | New CVE Received | [email protected] |