A missing CSRF token in the WP Google Review Slider plugin allows an attacker to craft a forged request that passes SQL code to the site’s database. The plugin concatenates user‑supplied parameters directly into SQL statements without validation, enabling the injected code to potentially read, modify, or delete review data. Based on the description, it is inferred that the vulnerability is classified as CWE‑352 because it facilitates cross‑site request forgery reaching the backend database layer.

WordPress installations that load the jgwhite33 WP Google Review Slider plugin, version 16.0 or older, are vulnerable. The plugin displays Google reviews in a slider and is maintained by jgwhite33.

The flaw carries a CVSS score of 8.2, indicating high severity potential for data compromise. The EPSS score is below 1%, suggesting that exploitation in the wild is currently rare, and the issue is not recorded in CISA’s KEV catalog. The vulnerability exploits missing CSRF protection; while the description does not specify credential or privilege requirements, it is inferred that an attacker would need to send a forged request that the site accepts, potentially relying on a victim’s logged‑in session to complete the injection.