The WP Review Slider Pro plugin for WordPress contains an unrecoverable SQL injection flaw in the wprp_load_more_revs AJAX action. The action reads a POST parameter named ‘notinstring’ via $_POST['notinstring'], sanitizes it only with sanitize_text_field() (which removes HTML but not SQL syntax) and concatenates the value directly into an unquoted numeric NOT IN clause. Because the value is not passed through $wpdb->prepare() or cast to an integer, and wp_magic_quotes cannot escape numeric contexts, an attacker can inject a classic instance of CWE‑89. An attacker who can reach any public page that renders the plugin short‑code can obtain the nonces exposed via wp_localize_script and send crafted requests to the AJAX endpoint, enabling a blind or time‑based extraction of database contents.

All installations of WP Review Slider Pro up to and including version 12.7.2 that render the plugin short‑code on publicly accessible WordPress pages are affected. The vulnerability exists whenever the AJAX endpoint is reachable, which occurs if the plugin short‑code is present on any public page. The plugin is distributed by wpreviewslider.com.

The flaw has a CVSS base score of 7.5, indicating high severity. The EPSS score is below 1%, suggesting that exploitation has not been observed yet but remains possible. The issue is not listed in CISA’s KEV catalog. An unauthenticated attacker who can access a public page containing the plugin can, cause the application to execute a malicious SQL query, exposing database contents. The attack requires no prior authentication and can be performed entirely from the client side.