The Joomla Component vReview 1.9.11 contains an unchecked SQL injection that can be triggered by unauthenticated attackers sending a POST request to the editReview endpoint. By injecting specially crafted code into the cmId parameter, an attacker may execute arbitrary SQL statements, including UNION queries that reveal sensitive data such as usernames, passwords, and database version information. The flaw is a classic CWE‑89 injection, leading to potential data theft and database compromise.

The affected product is the Wdmtech vReview component for Joomla, specifically version 1.9.11. Any site that has this component installed and exposed to the web is vulnerable if the editReview task is reachable without authentication.

The CVSS base score of 8.8 labels this vulnerability as high severity. Although no EPSS value is listed, the lack of required authentication and the straightforward nature of the SQL injection suggest a high likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, but the potential impact on confidentiality is significant. Attackers can exploit it by crafting a malicious POST request to the editReview endpoint, bypassing ordinary access controls.