CVE-2026-66427 jgwhite33 CVE debrief

Who should care

Administrators and security teams responsible for WordPress installations with the WP Google Review Slider plugin version 18.4 or earlier should prioritize patching this HIGH severity vulnerability. They should verify plugin versions, configurations, and monitor for suspicious SQL queries.

Technical summary

CVE-2026-66427 is a SQL injection vulnerability in the WP Google Review Slider plugin for WordPress, affecting versions up to and including 18.4. The vulnerability has a CVSS score of 7.6 and is classified as HIGH severity. It requires administrator privileges to exploit, allowing attackers to inject malicious SQL code. The vulnerability can be mitigated by patching the plugin to a version beyond 18.4.

Defensive priority

Patching is recommended as the primary defensive measure. Verify plugin version and update to a patched version if necessary. Implement WAF rules to detect SQL injection attempts and monitor for suspicious SQL queries.

Recommended defensive actions

• Patch the WP Google Review Slider plugin to a version beyond 18.4
• Verify plugin version and configuration
• Monitor for suspicious SQL queries
• Implement WAF rules to detect SQL injection attempts

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further investigation and verification are necessary to fully understand the impact and affected scope. Evidence is limited to CVE and NVD entries. Defenders should verify plugin versions, configurations, and monitor for suspicious SQL queries.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.