Description
WordPress Plugin Google Review Slider 6.1 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'tid' parameter. Attackers can send GET requests to the admin interface with malicious 'tid' values to extract sensitive database information using time-based blind SQL injection techniques.
Published: 2026-06-04
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a time-based blind SQL injection that allows unauthenticated attackers to inject malicious SQL code through the 'tid' parameter of the Google Review Slider plugin. By sending crafted GET requests to the admin interface, attackers can cause the database to execute arbitrary SQL, which can be used to extract sensitive data. The flaw results in disclosure of confidential information and is identified by CWE-89.

Affected Systems

The issue affects the WordPress plugin Google Review Slider version 6.1, published by jgwhite33. Impacted systems are WordPress installations that have this plugin deployed and have the admin interface exposed.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity vulnerability. The exploit is likely to be performed via HTTP GET requests to the unprotected admin area, and it does not require authentication. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, but the high CVSS score and lack of authentication requirement still pose a serious risk of data theft.

Generated by OpenCVE AI on June 4, 2026 at 14:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Google Review Slider plugin to the latest version where the 'tid' parameter is sanitized or removed.
  • If an upgrade is not feasible, disable or delete the plugin to eliminate the attack surface.
  • Configure a web application firewall or access control rules to block malicious queries that contain arbitrary SQL code in the 'tid' parameter or restrict access to the admin interface to trusted IP addresses.

Generated by OpenCVE AI on June 4, 2026 at 14:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 05 Jun 2026 08:00:00 +0000

Type Values Removed Values Added
First Time appeared Jgwhite33
Jgwhite33 wp Google Review Slider
Wordpress
Wordpress wordpress
Vendors & Products Jgwhite33
Jgwhite33 wp Google Review Slider
Wordpress
Wordpress wordpress

Thu, 04 Jun 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 04 Jun 2026 13:30:00 +0000

Type Values Removed Values Added
Description WordPress Plugin Google Review Slider 6.1 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'tid' parameter. Attackers can send GET requests to the admin interface with malicious 'tid' values to extract sensitive database information using time-based blind SQL injection techniques.
Title WordPress Plugin Google Review Slider 6.1 SQL Injection via tid
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'}

cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Jgwhite33 Wp Google Review Slider
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-06-04T14:33:25.582Z

Reserved: 2026-06-04T11:24:45.478Z

Link: CVE-2019-25745

cve-icon Vulnrichment

Updated: 2026-06-04T14:33:22.171Z

cve-icon NVD

Status : Deferred

Published: 2026-06-04T14:16:33.883

Modified: 2026-06-04T15:00:40.757

Link: CVE-2019-25745

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-05T07:45:35Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')