Vulnerability

CVE-2026-84097

Descriptive record received from OpenCTI and minimised for consultation in the Intel portal.

Sharing: PUBLIC-OSINT
Confidence: 100
Source: The CVE Program
Updated: 26/09/2026 14:14

Description

The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are then returned to unauthenticated visitors.

STIX identifiervulnerability--2c348603-3eac-5c40-954b-e248535d1b23

First observation-

Last observation-

Known relationships5

Aliases and classifications

CWE-89SQL Injection

Minimised technical details

No raw data

cisa kev: False

Provenance

Public references

exploit
https://wpscan.com/vulnerability/6d51f9c7-3140-4261-954b-8fc497587359/

EudorIA correlation

Intel catalogue

The vulnerability is also available in the EudorIA editorial catalogue.

Open EudorIA analysis

Presence in OpenCTI describes an intelligence correlation and does not, by itself, constitute evidence of compromise, legal attribution or operational guidance applicable without context verification.