wp-review-slider-pro does not sanitize a value stored through an AJAX handler that omits a capability check before using it in a SQL statement. This flaw gives any authenticated user, including standard subscribers, the ability to inject SQL code. The results of the injected query are returned to unauthenticated visitors, enabling information disclosure and potentially other unintended database modifications. The weakness exemplifies classic SQL injection (CWE-89).

The vulnerable product is the WordPress plugin wp‑review‑slider‑pro. Versions earlier than 12.7.12 are affected. No vendor‑specific patch version is listed; users should review the plugin repository for the latest release that addresses this.

The CVSS score is 6.5, and the EPSS score is < 1%, which indicates a low but nonzero exploitation probability. The KEV catalog does not list this vulnerability, so no officially documented exploitation has been reported. Nonetheless, because the flaw can be triggered by any logged‑in user with subscriber privileges and the injected data is presented to unauthenticated visitors, the impact can be readily observed on the public site. Based on the description, it is inferred that attackers can construct payloads via the plugin’s front‑end AJAX endpoint without additional preconditions. The absence of an official fix suggests that the community may start exploiting the vulnerability, so vigilance is advised.