The WP Review Slider Pro plugin for WordPress contains a SQL Injection vulnerability in the wpfb_find_reviews AJAX action. The 'curselrevs[]' parameter is concatenated directly into a SQL statement without sanitization or quoting, allowing an attacker with Subscriber-level access or higher to inject additional SQL statements. This flaw can be leveraged to read arbitrary data from the database, exposing sensitive information such as user credentials, post content, or configuration settings. The weakness is categorized as CWE‑89.

All installations of WP Review Slider Pro version 12.6.8 or earlier on a WordPress site are affected. Any user role with Subscriber or higher permission that can trigger the wpfb_find_reviews AJAX request is at risk. The plugin applies to the standard WordPress environment where the plugin is active.

The CVSS score of 8.8 indicates a high severity vulnerability, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild at this time. It is not listed in the CISA KEV catalog, so there is no evidence of active exploitation campaigns yet. Attackers would need valid WordPress credentials and permission to execute AJAX requests; the vulnerability does not allow unauthenticated or remote code execution. Nonetheless, the ability to exfiltrate database content poses significant confidentiality and integrity risks.